CVEvulnerability
CVE-2018-1311
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-12-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-416
Description
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
Affected configurations
• apache xerces-c\+\+ (>= 3.0.0 < 3.2.5)
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux eus 7.7
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.7
• redhat enterprise linux server tus 7.7
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• debian debian linux 9.0
• debian debian linux 10.0
• oracle goldengate (< 21.4.0.0.0)
• fedoraproject fedora 38
• fedoraproject fedora 39
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- http://www.openwall.com/lists/oss-security/2024/02/16/1 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0702 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0704 Third Party Advisory
- https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3E Vendor Advisory
- https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/ Mailing List, Third Party Advisory
- https://marc.info/?l=xerces-c-users&m=157653840106914&w=2 Mailing List, Third Party Advisory
- https://www.debian.org/security/2020/dsa-4814 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/02/16/1 Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0702 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0704 Third Party Advisory
- https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3E Vendor Advisory
- https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3E Issue Tracking
- https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/ lists.fedoraproject.org
- https://marc.info/?l=xerces-c-users&m=157653840106914&w=2 Mailing List, Third Party Advisory
- https://www.debian.org/security/2020/dsa-4814 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory