Lucene search

ApacheCVELIST:CVE-2024-23807

HistoryFeb 28, 2024 - 1:50 p.m.

CVE-2024-23807 Apache Xerces C++: Use-after-free on external DTD scan

2024-02-2813:50:39

CWE-416

apache

www.cve.org

apache xerces c++

use-after-free

external dtd

version 3.2.5

dtd processing

dom

sax

xerces_disable_dtd

cve-2024-23807

cve-2018-1311

AI Score

8.3

Confidence

High

EPSS

0.014

Percentile

86.6%

JSON

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.

Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.

This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Xerces C++",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.2.5",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

github.com/apache/xerces-c/pull/54

lists.apache.org/thread/c497tgn864tsbm8w0bo3f0d81s07zk9r