The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature or via SAX using the XERCES_DISABLE_DTD environment variable.

🗓️ 06 Apr 2022 07:00:00Reported by MicrosoftType

Xerces-C 3.0.0–3.2.3 has a use-after-free in external document type definitions; disable processing.

Reporter	Title	Published	Views	Family All 140
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are affected by vulnerabilities in Apache Xerces-C 3.0.0 to 3.2.2 XML parser (CVE-2018-1311)	20 Jan 202105:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Xerces-C (CVE-2018-1311)	17 Nov 202116:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products	14 Oct 202016:31	–	ibm
ATTACKERKB	CVE-2024-23807	29 Feb 202401:44	–	attackerkb
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2020-1415)	24 Apr 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2024-2476)	5 Mar 202400:00	–	nessus
Tenable Nessus	CentOS 6 : xerces-c (RHSA-2020:0702)	6 Mar 202000:00	–	nessus
Tenable Nessus	CentOS 7 : xerces-c (RHSA-2020:0704)	6 Mar 202000:00	–	nessus
Tenable Nessus	Debian DLA-2498-1 : xerces-c security update	18 Dec 202000:00	–	nessus
Tenable Nessus	Debian dla-3704 : libxerces-c-dev - security update	22 Jan 202500:00	–	nessus