CVE-2024-23807
Assigner: apache
Published: 2024-02-28T13:50:39.904Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Xerces C++
vendor: Apache Software Foundation
versions: lessThan: 3.2.5
status: affected
version: 3.0.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <div>The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.</div><div><br></div><div>Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.<br></div><div><br></div><div>This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.<br></div>
value: The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.

Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.

This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.


metrics: other: content: text: moderate
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
source: defect: XERCESC-2188
discovery: UNKNOWN
title: Apache Xerces C++: Use-after-free on external DTD scan
x_generator: engine: Vulnogram 0.1.0-dev