The vulnerability of the XML Xerces-C library, related to memory usage after it is freed, allows attackers to access confidential information or cause service failures.

🗓️ 08 Jul 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The Xerces parser has memory use-after-free and document type scanning flaws that expose data.

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are affected by vulnerabilities in Apache Xerces-C 3.0.0 to 3.2.2 XML parser (CVE-2018-1311)	20 Jan 202105:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Xerces-C (CVE-2018-1311)	17 Nov 202116:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products	14 Oct 202016:31	–	ibm
ATTACKERKB	CVE-2024-23807	29 Feb 202401:44	–	attackerkb
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2020-1415)	24 Apr 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2024-2476)	5 Mar 202400:00	–	nessus
Tenable Nessus	CentOS 6 : xerces-c (RHSA-2020:0702)	6 Mar 202000:00	–	nessus
Tenable Nessus	CentOS 7 : xerces-c (RHSA-2020:0704)	6 Mar 202000:00	–	nessus
Tenable Nessus	Debian DLA-2498-1 : xerces-c security update	18 Dec 202000:00	–	nessus
Tenable Nessus	Debian dla-3704 : libxerces-c-dev - security update	22 Jan 202500:00	–	nessus

Vulners

Node

apache xercesRange3.0.0–3.2.2

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1311
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-1311
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210730SE16
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.10/
web	www.web.nvd.nist.gov/view/vuln/detail

03 Apr 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 26.8

CVSS 38.1

EPSS0.09503

Xerces parser use after free document type scanning data exposure service disruption