Vulnerability Description
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Xerces-C\+\+ | >= 3.0.0, < 3.2.5 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Eus | 7.7 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Aus | 7.7 |
| Redhat | Enterprise Linux Server Tus | 7.7 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Debian | Debian Linux | 9.0 |
| Oracle | Goldengate | < 21.4.0.0.0 |
| Fedoraproject | Fedora | 38 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2024/02/16/1Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0702Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0704Third Party Advisory
- https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600bVendor Advisory
- https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfIssue Tracking
- https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d9Issue Tracking
- https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830aIssue Tracking
- https://lists.debian.org/debian-lts-announce/2020/12/msg00025.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00027.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://marc.info/?l=xerces-c-users&m=157653840106914&w=2Mailing ListThird Party Advisory
- https://www.debian.org/security/2020/dsa-4814Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2024/02/16/1Mailing ListThird Party Advisory
FAQ
What is CVE-2018-1311?
CVE-2018-1311 is a vulnerability with a CVSS score of 8.1 (HIGH). The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library ...
How severe is CVE-2018-1311?
CVE-2018-1311 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1311?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Xerces-C\+\+, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus.