Apache Xerces-C++ vulnerabilities

11 CVEs affecting Apache Xerces-C++, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-23807, published 2024-02-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0252, published 2015-03-24. Medium severity, CVSS 5.0. EPSS: 39.7% chance of exploitation in the next 30 days. internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
CVE-2016-4463, published 2016-07-08. High severity, CVSS 7.5. EPSS: 14.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
CVE-2018-1311, published 2019-12-18. High severity, CVSS 8.1. EPSS: 9.5% chance of exploitation in the next 30 days. The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library…
CVE-2017-12627, published 2018-03-01. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
CVE-2016-2099, published 2016-05-13. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML…
CVE-2004-1575, published 2004-12-31. Medium severity, CVSS 5.0. EPSS: 6.2% chance of exploitation in the next 30 days. The XML parser in Xerces-C++ 2.5.0 allows remote attackers to cause a denial of service (CPU consumption) via XML attributes in a crafted XML document.
CVE-2009-1885, published 2009-08-11. Medium severity, CVSS 4.3. EPSS: 5.3% chance of exploitation in the next 30 days. Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors…
CVE-2012-0880, published 2017-08-08. High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days. Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
CVE-2008-4482, published 2008-10-08. High severity, CVSS 7.8. EPSS: 4.2% chance of exploitation in the next 30 days. The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value,…
CVE-2023-37536, published 2023-10-11. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

Latest

CVE-2024-23807, published 2024-02-29. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5…