Description
The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs.
Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Xerces C++ | 3.0.0 – < 3.2.5 | 3.2.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | xerces-c | 3.2.3+debian-3ubuntu0.1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | xerces-c | 3.2.3+debian-3ubuntu0.1~esm1 | — |
| Ubuntu Pro 18.04 LTS | xerces-c | 3.2.0+debian-2ubuntu0.1~esm2 | — |
| Ubuntu Pro 16.04 LTS | xerces-c | 3.1.3+debian-1ubuntu0.1~esm2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xerces-c +2 | 3.1.1-10.amzn2.0.2 | ALAS2-2024-2476 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xerces-c | 3.2.4-2 | — |
| Azure Linux 2 (CBL-Mariner) | xerces-c | 3.2.4-2 | — |
Advisories 20
- WID-SEC-2026-0165 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-3191 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 11, 2026
- NCSC-2025-0336 Kwetsbaarheden verholpen in Oracle Hyperion NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2366 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2025
- NCSC-2025-0131 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Apr 16, 2025
- WID-SEC-2025-0814 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- WID-SEC-2025-0163 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 21, 2025
- WID-SEC-2024-1642 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2024
- NCSC-2024-0417 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
- NCSC-2024-0411 Kwetsbaarheden verholpen in Oracle Database producten NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3219 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-3196 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- WID-SEC-2024-3190 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
- NCSC-2024-0297 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0294 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 17, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- WID-SEC-2024-1638 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- ALAS2-2024-2476 Moderate: xerces-c security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 4, 2024