Every CVE Search/ Get API key

CVE-2015-0252

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial...

5.0 MediumPublic exploitFix available

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Exploit likelihood

38.7%Down 33.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
CVE-2015-0252
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
CVE-2015-0252
Updated
2026-11-02
EUVDEUVD-2015-0273 No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
EUVD-2015-0273
Updated
2026-11-03
GitHub AdvisoriesGHSA-394g-p2rq-jhvm No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial...

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
GHSA-394g-p2rq-jhvm
Weakness
CWE-20
Updated
2026-11-02
OSV No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
CVE-2015-0252
Updated
2026-11-02
OSVDEBIAN-CVE-2015-0252 No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
DEBIAN-CVE-2015-0252
Updated
2026-11-02
OSVMGASA-2015-0136 No score

Updated xerces-c packages fix security vulnerabilities

Updated xerces-c packages fix security vulnerability:

Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c. The parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. An unauthenticated attacker could use this flaw to cause an application using the xerces-c library to crash (CVE-2015-0252).

Record
MGASA-2015-0136
Updated
2026-11-02
OSVSUSE-SU-2015:0597-1 No score

Security update for Xerces-C

The Xerces-C XML parsing library was updated to fix mishandling certain kinds of malformed input documents, that could have resulted in a segmentation faults during a parse operation, leading to denial of service or potential code execution. (bnc#920810,CVE-2015-0252)

Record
SUSE-SU-2015:0597-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-0252 No score

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

Record
UBUNTU-CVE-2015-0252
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xerces-c
Debian:12
 before 3.1.1-5.1
3.1.1-5.1
xerces-c
Debian:13
 before 3.1.1-5.1
3.1.1-5.1
xerces-c
Debian:14
 before 3.1.1-5.1
3.1.1-5.1
xerces-c
Debian:6.0
 before 3.1.1-1+deb6u1, plus listed versions
3.1.1-1
3.1.1-1+deb6u1
xerces-c
Debian:7
 before 3.1.1-3+deb7u1, plus listed versions
3.1.1-3
3.1.1-3+deb7u1
xerces-c
Mageia:4
 before 3.1.2-1.mga4
3.1.2-1.mga4
xerces-c
Red Hat:enterprise_linux:7::client
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-devel
Red Hat:enterprise_linux:7::client
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-doc
Red Hat:enterprise_linux:7::client
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
xerces-c
Red Hat:enterprise_linux:7::server
 before 0:3.1.1-7.ael7b_1
0:3.1.1-7.ael7b_1
xerces-c-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.1.1-7.ael7b_1
0:3.1.1-7.ael7b_1
xerces-c-devel
Red Hat:enterprise_linux:7::server
 before 0:3.1.1-7.ael7b_1
0:3.1.1-7.ael7b_1
xerces-c-doc
Red Hat:enterprise_linux:7::server
 before 0:3.1.1-7.ael7b_1
0:3.1.1-7.ael7b_1
xerces-c
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c-doc
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.1-7.el7_1
0:3.1.1-7.el7_1
xerces-c
SUSE:Linux Enterprise Desktop 12
 before 3.1.1-4.1
3.1.1-4.1
xerces-c
SUSE:Linux Enterprise Workstation Extension 12
 before 3.1.1-4.1
3.1.1-4.1
xerces-c
Ubuntu:14.04:LTS
 before 3.1.1-5.1~build0.14.04.1, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-43.1.1-5
3.1.1-5.1~build0.14.04.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC)2015-05-04

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0252 is a medium vulnerability (CVSS 5.0) in Apache Xerces-c\+\+, published March 9, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.7%, the 98th percentile. Fixed in xerces-c 3.1.1-5.1.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open