Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xerces-c-develUpgrade xerces-cUpgrade xerces-c-doc | Jul 6, 2016 | Mar 10, 2016 |
| Debian | — | Upgrade xerces-c | Feb 25, 2016 | Feb 25, 2016 |
| Freebsd | — | Upgrade xerces-c3 | Dec 10, 2025 | Feb 28, 2016 |
| Gentoo Linux | — | Upgrade dev-libs/xerces-c. | Oct 30, 2017 | Apr 7, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade xerces-c | Nov 30, 2017 | Apr 7, 2016 |
| Oracle_linux | — | Upgrade xerces-c-docUpgrade xerces-c-develUpgrade xerces-c | Mar 10, 2016 | Mar 10, 2016 |
| Suse | — | Upgrade libxerces-c-3_2Upgrade libxerces-c-3_1-32bitUpgrade libxerces-c-develUpgrade libxerces-c-3_1 | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | Upgrade xerces-c | Nov 19, 2024 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub