Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade xerces-c-docUpgrade xerces-cUpgrade xerces-c-debuginfoUpgrade xerces-c-devel | Apr 27, 2020 | Jul 8, 2016 |
| Centos_linux | — | Upgrade xerces-c-debuginfoUpgrade xerces-c-develUpgrade xerces-cUpgrade xerces-c-doc | Aug 28, 2019 | Jul 8, 2016 |
| Debian | — | Upgrade xerces-c | Jun 30, 2016 | Jun 29, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 15, 2016 |
| Freebsd | — | Upgrade xerces-c3 | Dec 10, 2025 | Jul 26, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade xerces-c | Dec 31, 2018 | Jul 8, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade xerces-c | Dec 11, 2018 | Jul 8, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xerces-c | Nov 19, 2019 | Jul 8, 2016 |
| Oracle_linux | — | Upgrade xerces-c-docUpgrade xerces-c-develUpgrade xerces-c | Nov 6, 2018 | Jun 29, 2016 |
| Redhat_linux | — | Upgrade xerces-c-docNo solution existsUpgrade xerces-c-develUpgrade xerces-cUpgrade xerces-c-debuginfo | Oct 31, 2018 | Jul 8, 2016 |
| Suse | — | Upgrade libxerces-c-develUpgrade xerces-cUpgrade libxerces-c-3_1Upgrade libxerces-c-3_2Upgrade libxerces-c-3_1-32bitUpgrade libXerces-c28 | Jul 26, 2016 | Jul 8, 2016 |
| Ubuntu | — | Upgrade libxerces-c-doc (Ubuntu Pro)Upgrade libxerces-c-samples (Ubuntu Pro)Upgrade libxerces-c3.1 (Ubuntu Pro)Upgrade libxerces-c3.2 (Ubuntu Pro)Upgrade libxerces-c-dev (Ubuntu Pro) | Mar 22, 2023 | Jul 8, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub