{"id":"CVE-2018-1311","aliases":["DEBIAN-CVE-2018-1311","DLA-2498-1","DSA-4814-1","EUVD-2018-11912","GHSA-7rpp-hwhj-9hv8","MGASA-2020-0296","OESA-2024-1160","OESA-2024-1232","OESA-2024-1233","OESA-2024-1234","OESA-2024-1235","OESA-2024-1236","RHSA-2020:0702","RHSA-2020:0704","SUSE-SU-2021:2920-1","SUSE-SU-2021:2944-1","SUSE-SU-2021:2958-1","SUSE-SU-2024:0299-1","SUSE-SU-2024:0300-1","SUSE-SU-2024:0320-1","UBUNTU-CVE-2018-1311","USN-6579-1","USN-6579-2","USN-6590-1","openSUSE-SU-2021:1231-1","openSUSE-SU-2021:2958-1","openSUSE-SU-2024:13540-1"],"status":"published","title":"The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during...","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09503,"percentile":0.95477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2019-12-18T00:00:00Z","modified":"2026-10-23T18:03:54Z","exploits":[{"source":"pocgithub","id":"johnjamesmccann/xerces-3.2.3-DTD-hotfix","title":"johnjamesmccann/xerces-3.2.3-DTD-hotfix","date":"2022-01-20","url":"https://github.com/johnjamesmccann/xerces-3.2.3-DTD-hotfix"}],"fixes":[{"ecosystem":"Debian:12","package":"xerces-c","fixed_in":["3.2.3+debian-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xerces-c","fixed_in":["3.2.3+debian-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xerces-c","fixed_in":["3.2.3+debian-2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"xerces-c","fixed_in":["3.1.4+debian-2+deb9u2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"xerces-c","fixed_in":["3.2.2+debian-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"xerces-c","fixed_in":["3.2.2-2.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xerces-c","fixed_in":["3.2.2-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"xerces-c","fixed_in":["3.2.2-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"xerces-c","fixed_in":["3.2.2-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"xerces-c","fixed_in":["3.2.2-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"xerces-c","fixed_in":["3.2.2-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"xerces-c","fixed_in":["3.2.2-5.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-debuginfo","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-devel","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-doc","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-debuginfo","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-devel","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-doc","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-debuginfo","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-devel","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-doc","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-debuginfo","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-devel","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-doc","fixed_in":["0:3.0.1-21.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-debuginfo","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-devel","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-doc","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-debuginfo","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-devel","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-doc","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-debuginfo","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-devel","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-doc","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-debuginfo","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-devel","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-doc","fixed_in":["0:3.1.1-10.el7_7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"xerces-c","fixed_in":["3.1.4-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xerces-c","fixed_in":["3.1.1-13.6.1","3.1.1-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xerces-c","fixed_in":["3.1.1-13.6.1","3.1.1-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xerces-c","fixed_in":["3.1.1-13.6.1","3.1.1-13.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"xerces-c","fixed_in":["3.1.4-10.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1","3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1","3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1","3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xerces-c","fixed_in":["3.1.4-150200.10.11.1","3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xerces-c","fixed_in":["3.2.3-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xerces-c","fixed_in":["3.1.1-5.1+deb8u4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xerces-c","fixed_in":["3.1.3+debian-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xerces-c","fixed_in":["3.2.0+debian-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"xerces-c","fixed_in":["3.2.2+debian-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xerces-c","fixed_in":["3.2.3+debian-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xerces-c","fixed_in":["3.2.3+debian-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"xerces-c","fixed_in":["3.1.4-lp152.5.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"xerces-c","fixed_in":["3.1.4-10.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xerces-c","fixed_in":["3.2.5-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4+debian-2+deb9u2"}]}],"versions":["3.1.4+debian-2+deb9u1"]},{"source":"osv","ecosystem":"Debian:10","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+debian-1+deb10u1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-5.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-21.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xerces-c-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-10.el7_7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-10.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150200.10.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.1+deb8u4ubuntu0.1~esm1"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-4","3.1.1-5","3.1.1-5.1~build0.14.04.1","3.1.1-5.1+deb8u1build0.14.04.1","3.1.1-5.1+deb8u2build0.14.04.1","3.1.1-5.1+deb8u3build0.14.04.1","3.1.1-5.1+deb8u4build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3+debian-1ubuntu0.1~esm2"}]}],"versions":["3.1.1-5.1","3.1.2+debian-1","3.1.3+debian-1","3.1.3+debian-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+debian-2ubuntu0.1~esm2"}]}],"versions":["3.1.4+debian-2","3.1.4+debian-2build1","3.2.0+debian-2","3.2.0+debian-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+debian-1ubuntu0.1"}]}],"versions":["3.2.2+debian-1build1","3.2.2+debian-1build2","3.2.2+debian-1build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-3ubuntu0.1"}]}],"versions":["3.2.3+debian-3","3.2.3+debian-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-3ubuntu0.1~esm1"}]}],"versions":["3.2.3+debian-3","3.2.3+debian-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.1+deb8u4ubuntu0.1~esm1"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-4","3.1.1-5","3.1.1-5.1~build0.14.04.1","3.1.1-5.1+deb8u1build0.14.04.1","3.1.1-5.1+deb8u2build0.14.04.1","3.1.1-5.1+deb8u3build0.14.04.1","3.1.1-5.1+deb8u4build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3+debian-1ubuntu0.1~esm2"}]}],"versions":["3.1.1-5.1","3.1.2+debian-1","3.1.3+debian-1","3.1.3+debian-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+debian-2ubuntu0.1~esm2"}]}],"versions":["3.1.4+debian-2","3.1.4+debian-2build1","3.2.0+debian-2","3.2.0+debian-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+debian-1ubuntu0.1"}]}],"versions":["3.2.2+debian-1build1","3.2.2+debian-1build2","3.2.2+debian-1build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-3ubuntu0.1~esm1"}]}],"versions":["3.2.3+debian-3","3.2.3+debian-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.1+deb8u4ubuntu0.1~esm2"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-4","3.1.1-5","3.1.1-5.1~build0.14.04.1","3.1.1-5.1+deb8u1build0.14.04.1","3.1.1-5.1+deb8u2build0.14.04.1","3.1.1-5.1+deb8u3build0.14.04.1","3.1.1-5.1+deb8u4build0.14.04.1","3.1.1-5.1+deb8u4ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3+debian-1ubuntu0.1~esm3"}]}],"versions":["3.1.1-5.1","3.1.2+debian-1","3.1.3+debian-1","3.1.3+debian-1ubuntu0.1~esm1","3.1.3+debian-1ubuntu0.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0+debian-2ubuntu0.1~esm3"}]}],"versions":["3.1.4+debian-2","3.1.4+debian-2build1","3.2.0+debian-2","3.2.0+debian-2ubuntu0.1~esm1","3.2.0+debian-2ubuntu0.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2+debian-1ubuntu0.2"}]}],"versions":["3.2.2+debian-1build1","3.2.2+debian-1build2","3.2.2+debian-1build3","3.2.2+debian-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3+debian-3ubuntu0.1"}]}],"versions":["3.2.3+debian-3","3.2.3+debian-3build1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-lp152.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-10.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xerces-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-1.1"}]}]}],"products":[{"vendor":"apache","product":"xerces-c\\+\\+"},{"vendor":"apache software foundation","product":"apache xerces-c"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"goldengate"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3E","tags":["mailing-list","x_transferred","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0704","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0702","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4814","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3E","tags":["mailing-list","x_transferred","Issue Tracking","report"]},{"url":"https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3E","tags":["mailing-list","x_transferred","Issue Tracking","report"]},{"url":"https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3E","tags":["mailing-list","x_transferred","Issue Tracking","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://marc.info/?l=xerces-c-users\u0026m=157653840106914\u0026w=2","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/02/16/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1311","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b@%3Cc-dev.xerces.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35@%3Cc-users.xerces.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646@%3Cc-users.xerces.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625@%3Cc-users.xerces.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD"},{"url":"https://github.com/advisories/GHSA-7rpp-hwhj-9hv8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1311","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0296.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26311","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1160","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1232","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1233","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1234","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1235","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1236","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788472","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0702.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1311","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1311","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0704.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212920-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159552","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1311","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212944-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212958-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240299-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240300-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240320-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1311","tags":["report"]},{"url":"http://xerces.apache.org/xerces-c/secadv/CVE-2018-1311.txt","tags":["report"]},{"url":"https://issues.apache.org/jira/projects/XERCESC/issues/XERCESC-2188","tags":["report"]},{"url":"https://github.com/apache/xerces-c/pull/47","tags":["report"]},{"url":"https://github.com/apache/xerces-c/pull/54","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6579-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6579-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6590-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-37536","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GBRNNZMHWDSWWFESWQDTSNE4Q5NETCUO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BGBVRVIJEOW5LG3NVS52NA3VNX37UM7D/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T00:00:00Z","modified":"2025-11-04T18:14:14.531Z","updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11912","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T00:00:00Z","modified":"2025-11-04T18:14:14Z","updated_at":"2026-11-02T19:49:25.004858Z"}],"ghsa":[{"id":"GHSA-7rpp-hwhj-9hv8","title":"The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during...","description":"The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2022-05-24T17:03:53Z","modified":"2025-11-04T21:30:24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:35.00238Z"}],"nvd":[{"id":"CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T20:15:15.493Z","modified":"2026-06-17T01:50:59.29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:59.278647Z"}],"osv":[{"id":"CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T20:15:15.493Z","modified":"2026-04-16T04:32:04.28594605Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T20:15:15.493Z","modified":"2026-10-23T18:03:54.613018844Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"OESA-2024-1160","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-02-23T11:06:36Z","modified":"2026-08-18T01:18:15.293479055Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1232","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-03-01T11:06:40Z","modified":"2026-08-18T01:18:16.362260538Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1233","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-03-01T11:06:40Z","modified":"2026-08-18T01:18:16.221714514Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1234","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-03-01T11:06:40Z","modified":"2026-08-18T01:18:17.552626954Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1235","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-03-01T11:06:40Z","modified":"2026-08-18T01:18:17.740502417Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1236","title":"xerces-c security update","description":"Xerces-C is a validating XML parser written in a portable subset of C++. Xerces-C makes it easy to give your application the ability to read and write XML data. A shared library is provided for parsing, generating, manipulating, and validating XML documents. Xerces-C is faithful to the XML 1.0 recommendation and associated standards ( DOM 1.0, DOM 2.0. SAX 1.0, SAX 2.0, Namespaces).\r\n\r\nSecurity Fix(es):\r\n\r\nThe Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.(CVE-2018-1311)","status":"published","published":"2024-03-01T11:06:41Z","modified":"2026-08-18T01:18:17.700282469Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2020:0702","title":"Red Hat Security Advisory: xerces-c security update","status":"published","published":"2024-09-16T03:37:29Z","modified":"2025-11-22T11:56:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0704","title":"Red Hat Security Advisory: xerces-c security update","status":"published","published":"2024-09-16T03:37:39Z","modified":"2026-06-26T10:46:27Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","status":"published","published":"2019-12-18T20:15:00Z","modified":"2026-04-22T11:44:57.540387Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-2498-1","title":"xerces-c - security update","status":"published","published":"2020-12-17T00:00:00Z","modified":"2026-03-09T01:20:54.84292Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4814-1","title":"xerces-c - security update","status":"published","published":"2020-12-17T00:00:00Z","modified":"2026-03-09T02:08:32.627191Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0296","title":"Updated xerces-c packages fix security vulnerability","description":"A use-after-free vulnerability was found in xerces-c in the way an XML\ndocument is processed via the SAX API. Applications that process XML\ndocuments with an external Document Type Definition (DTD) may be\nvulnerable to this flaw. A remote attacker could exploit this flaw by\ncreating a specially crafted XML file that would crash the application or\npotentially lead to arbitrary code execution (CVE-2018-1311).\n","status":"published","published":"2020-07-31T23:25:42Z","modified":"2026-04-16T04:43:27.657363752Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2021:1231-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-09-06T12:04:11Z","modified":"2026-02-04T04:28:31.361896Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2958-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552).\n","status":"published","published":"2021-09-06T08:34:50Z","modified":"2026-02-04T02:51:48.97636Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:13540-1","title":"libxerces-c-3_2-3.2.5-1.1 on GA media","description":"These are all security issues fixed in the libxerces-c-3_2-3.2.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:17.97661Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2021:2920-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552).\n","status":"published","published":"2021-09-02T08:07:41Z","modified":"2026-02-04T04:36:17.389941Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2944-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552).\n","status":"published","published":"2021-09-03T07:27:48Z","modified":"2025-05-02T04:29:52.361887Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2958-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552).\n","status":"published","published":"2021-09-06T08:34:41Z","modified":"2025-05-02T04:29:52.422072Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2024:0299-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: fixed use-after-free triggered during the scanning of external DTDs potentially leading to DOS. (bsc#1159552)\n","status":"published","published":"2024-02-01T12:34:00Z","modified":"2026-02-04T02:55:18.436313Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0300-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: fixed use-after-free triggered during the scanning of external DTDs potentially leading to DOS. (bsc#1159552)\n","status":"published","published":"2024-02-01T12:34:32Z","modified":"2025-05-02T04:29:52.542647Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0320-1","title":"Security update for xerces-c","description":"This update for xerces-c fixes the following issues:\n\n- CVE-2018-1311: fixed use-after-free triggered during the scanning of external DTDs potentially leading to DOS. (bsc#1159552)\n","status":"published","published":"2024-02-02T12:15:01Z","modified":"2026-02-04T04:10:18.87152Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6579-1","title":"xerces-c vulnerability","description":"It was discovered that Xerces-C++ was not properly handling memory\nmanagement operations when parsing XML data containing external DTDs,\nwhich could trigger a use-after-free error. If a user or automated system\nwere tricked into processing a specially crafted XML document, an attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code.\n","status":"published","published":"2024-01-11T17:53:50Z","modified":"2026-06-29T13:46:57.567872241Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6579-2","title":"xerces-c vulnerability","description":"USN-6579-1 fixed a vulnerability in Xerces-C++. This update provides the\ncorresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04\nand Ubuntu 23.10.\n\nOriginal advisory details:\n\n It was discovered that Xerces-C++ was not properly handling memory\n management operations when parsing XML data containing external DTDs,\n which could trigger a use-after-free error. If a user or automated system\n were tricked into processing a specially crafted XML document, an attacker\n could possibly use this issue to cause a denial of service or execute\n arbitrary code.\n","status":"published","published":"2024-01-16T12:15:24Z","modified":"2026-04-22T10:43:38.419777Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6590-1","title":"xerces-c vulnerabilities","description":"It was discovered that Xerces-C++ was not properly handling memory\nmanagement operations when parsing XML data containing external DTDs,\nwhich could trigger a use-after-free error. If a user or automated system\nwere tricked into processing a specially crafted XML document, an attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2018-1311)\n\nIt was discovered that Xerces-C++ was not properly performing bounds\nchecks when processing XML Schema Definition files, which could lead to an\nout-of-bounds access via an HTTP request. If a user or automated system\nwere tricked into processing a specially crafted XSD file, a remote\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2023-37536)\n","status":"published","published":"2024-01-18T18:21:32Z","modified":"2026-06-29T13:51:00.780434715Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}