The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xerces-c | Aug 22, 2024 | Dec 18, 2019 |
| Amazon Linux Ami 2 | — | Upgrade xerces-c-develUpgrade xerces-c-debuginfoUpgrade xerces-c-docUpgrade xerces-c | Apr 27, 2020 | Dec 18, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 18, 2019 |
| Centos_linux | — | Upgrade xerces-cUpgrade xerces-c-debuginfoUpgrade xerces-c-develUpgrade xerces-c-doc | Mar 12, 2020 | Dec 18, 2019 |
| Debian | — | Upgrade xerces-c | Dec 18, 2020 | Dec 18, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade xerces-c | Jun 17, 2020 | Dec 18, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade xerces-c | Apr 30, 2021 | Dec 18, 2019 |
| Oracle_linux | — | Upgrade xerces-cUpgrade xerces-c-develUpgrade xerces-c-doc | Mar 7, 2020 | Dec 16, 2019 |
| Redhat_linux | — | Upgrade xerces-c-develUpgrade xerces-cUpgrade xerces-c-debuginfoUpgrade xerces-c-doc | Mar 12, 2020 | Dec 18, 2019 |
| Suse | — | Upgrade Xerces-cUpgrade libXerces-c-develUpgrade xerces-c-docUpgrade libxerces-c-3_1-32bitUpgrade libxerces-c-3_1 | Sep 3, 2021 | Dec 18, 2019 |
| Ubuntu | — | Upgrade libxerces-c-samplesUpgrade libxerces-c3.2Upgrade libxerces-c-samples (Ubuntu Pro)Upgrade libxerces-c3.2 (Ubuntu Pro)Upgrade libxerces-c3.1 (Ubuntu Pro) | Jan 12, 2024 | Dec 18, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub