CVE-2018-1311

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via...

Apache Xerces-C CVE-2018-1311 Remote Code Execution Vulnerability

Description Apache Xerces-C is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application or cause denial-of-service conditions. Apache Xerces-C versions 3.0.0 through 3.2.2 are vulnerable. Technologies...

xerces-c:parse_target: Use-of-uninitialized-value in xercesc_3_2::XMLString::compareNString

Detailed Report: https://oss-fuzz.com/testcase?key=5643481133613056 Project: xerces-c Fuzzing Engine: libFuzzer Fuzz Target: parsetarget Job Type: libfuzzermsanxerces-c Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: xercesc32::XMLString::compareNString...

EulerOS 2.0 SP5 : xerces-c (EulerOS-SA-2019-2199)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested...

Security Bulletin: Vulnerabilities in OpenSSL and Xerces-C affect IBM Netezza Platform Software (CVE-2016-2107, CVE-2016-2105, CVE-2016-0729)

Summary OpenSSL and Xerces-C are used by IBM Netezza Platform Software. IBM Netezza Platform Software has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error when the...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xerces-c Vulnerability (NS-SA-2019-0072)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xerces-c packages installed that are affected by a vulnerability: - A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an...

pki-deps:10.6 security update

apache-commons-collections 3.2.2-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora29MassRebuild 3.2.2-9 - Remove workaround for symlink-directory rpm bug jackson-bom 2.9.8-1 - Update to latest upstream release 2.9.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 2.9.4-1 -...

Fedora Update for xerces-c27 FEDORA-2018-51ce232320

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : xerces-c (openSUSE-2019-1283)

This update for xerces-c fixes the following issue : - CVE-2017-12627: Processing of external DTD paths could have resulted in a NULL pointer dereference under certain conditions bsc1083630 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network...

openSUSE: Security Advisory for xerces-c (openSUSE-SU-2019:1283-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1283-1 Security update for xerces-c

This update for xerces-c fixes the following issue: - CVE-2017-12627: Processing of external DTD paths could have resulted in a null pointer dereference under certain conditions bsc1083630 This update was imported from the SUSE:SLE-15:Update update project...

Security update for xerces-c (low)

openSUSE Security Update: Security update for xerces-c Announcement ID: openSUSE-SU-2019:1283-1 Rating: low References: 1083630 Cross-References: CVE-2017-12627 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for xerces-c fix...

SUSE SLED15 / SLES15 Security Update : xerces-c (SUSE-SU-2019:0977-1)

This update for xerces-c fixes the following issue : CVE-2017-12627: Processing of external DTD paths could have resulted in a NULL pointer dereference under certain conditions bsc1083630 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE-SU-2019:0977-1 Security update for xerces-c

This update for xerces-c fixes the following issue: - CVE-2017-12627: Processing of external DTD paths could have resulted in a null pointer dereference under certain conditions bsc1083630...

Photon OS 1.0: Xerces PHSA-2018-1.0-0126

An update of the xerces package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0126. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid12183...

The vulnerability of the Apache Xerces-C XML Parser for syntactic analysis and XML processing lies in its improper handling of DTD paths, which allows attackers to cause service failures.

The vulnerability of the Apache Xerces-C XML Parser for syntactic analysis and XML processing is related to incorrect handling of DTD paths. In some cases, this leads to the misuse of the zero pointer. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

Denial Of Service (DoS)

Xerces2-j aka Apache Xerces-J parser is vulnerable to denial of service DoS. The attack can be triggered when malicious XML data is passed to Apache Xerces-J parser and processed by the JRE...

Fedora 28 : mingw-gdal / mingw-xerces-c (2018-7b97e553ff)

Update to 3.2.1 CVE-2017-12627 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

EulerOS 2.0 SP2 : xerces-c (EulerOS-SA-2018-1422)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - xerces-c: Stack overflow when parsing deeply nested DTD CVE-2016-4463 Note that Tenable Network Security has extracted the preceding description...

EulerOS 2.0 SP3 : xerces-c (EulerOS-SA-2018-1395)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - xerces-c: Stack overflow when parsing deeply nested DTD CVE-2016-4463 Note that Tenable Network Security has extracted the preceding description...