Apache Xerces C
By the Year
In 2024 there have been 0 vulnerabilities in Apache Xerces C . Last year Xerces C had 1 security vulnerability published. Right now, Xerces C is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 1 | 8.80 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 8.10 |
| 2018 | 1 | 9.80 |
It may take a day or so for new Xerces C vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Xerces C Security Vulnerabilities
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform
CVE-2023-37536
8.8 - High
- October 11, 2023
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
Integer Overflow or Wraparound
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs
CVE-2018-1311
8.1 - High
- December 18, 2019
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
Dangling pointer
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths
CVE-2017-12627
9.8 - Critical
- March 01, 2018
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
NULL Pointer Dereference
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4
CVE-2016-4463
7.5 - High
- July 08, 2016
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Buffer Overflow
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2
CVE-2015-0252
- March 24, 2015
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Xerces C or by Apache? Click the Watch button to subscribe.
