OESA-2024-1232 xerces-c security update

🗓️ 01 Mar 2024 11:07:06Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Xerces-C 3.0.0–3.2.3 has a use-after-free in external DTD scanning; disable DTD processing.

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are affected by vulnerabilities in Apache Xerces-C 3.0.0 to 3.2.2 XML parser (CVE-2018-1311)	20 Jan 202105:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Xerces-C (CVE-2018-1311)	17 Nov 202116:26	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products	14 Oct 202016:31	–	ibm
ATTACKERKB	CVE-2024-23807	29 Feb 202401:44	–	attackerkb
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2020-1415)	24 Apr 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2 : xerces-c (ALAS-2024-2476)	5 Mar 202400:00	–	nessus
Tenable Nessus	CentOS 6 : xerces-c (RHSA-2020:0702)	6 Mar 202000:00	–	nessus
Tenable Nessus	CentOS 7 : xerces-c (RHSA-2020:0704)	6 Mar 202000:00	–	nessus
Tenable Nessus	Debian DLA-2498-1 : xerces-c security update	18 Dec 202000:00	–	nessus
Tenable Nessus	Debian dla-3704 : libxerces-c-dev - security update	22 Jan 202500:00	–	nessus

Source	Link
openeuler	www.openeuler.org/en/security/safety-bulletin/detail.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1311

03 Sep 2025 06:16Current

6.9Medium risk

Vulners AI Score6.9

CVSS 26.8

CVSS 3.18.1

EPSS0.04171

xerces-c external document type use after free document type processing vulnerability