CVE-2017-12627
xerces-c: Null pointer dereference while processing the path to DTD allows denial of service
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (mittel), Ubuntu (mittel).
Beschreibung
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | xerces-c | 3.2.1-1.ph1 |
| Photon OS 2.0 | xerces-c | 3.2.1-1.ph2 |
| Photon OS 3.0 | xerces-c | 3.2.1-1.ph3 |
| debian 11 | xerces-c | 3.2.1+debian-1 |
| debian 12 | xerces-c | 3.2.1+debian-1 |
| debian 13 | xerces-c | 3.2.1+debian-1 |
| debian 14 | xerces-c | 3.2.1+debian-1 |
| debian 7 | xerces-c | 3.1.1-3+deb7u5 |
| debian 8 | xerces-c | 3.1.1-5.1+deb8u4 |
| debian 9 | xerces-c | 3.1.4+debian-2+deb9u1 |
| echo | xerces-c, xerces-c-2.6.0 | 3.2.1+debian-1 und 1 weitere |
| Red Hat | xerces-c, xerces-c-devel, xerces-c-doc | kein Fix angegeben |
Alle 19 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | xerces-c | 3.2.1-1.ph1 |
| Photon OS 2.0 | xerces-c | 3.2.1-1.ph2 |
| Photon OS 3.0 | xerces-c | 3.2.1-1.ph3 |
| debian 11 | xerces-c | 3.2.1+debian-1 |
| debian 12 | xerces-c | 3.2.1+debian-1 |
| debian 13 | xerces-c | 3.2.1+debian-1 |
| debian 14 | xerces-c | 3.2.1+debian-1 |
| debian 7 | xerces-c | 3.1.1-3+deb7u5 |
| debian 8 | xerces-c | 3.1.1-5.1+deb8u4 |
| debian 9 | xerces-c | 3.1.4+debian-2+deb9u1 |
| echo | xerces-c | 3.2.1+debian-1 |
| echo | xerces-c-2.6.0 | 2.6.0+e1 |
| Red Hat | xerces-c | kein Fix angegeben |
| Red Hat | xerces-c-devel | kein Fix angegeben |
| Red Hat | xerces-c-doc | kein Fix angegeben |
| ubuntu 14.04 | xerces-c | 3.1.1-5.1+deb8u4build0.14.04.1 |
| ubuntu 14.04-ESM | xerces-c | 3.1.1-5.1+deb8u4build0.14.04.1 |
| ubuntu 16.04-ESM | xerces-c | 3.1.3+debian-1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | xerces-c | 3.2.0+debian-2ubuntu0.1~esm1 |
Referenzen
- http://seclists.org/oss-sec/2018/q1/203
- http://www.securityfocus.com/bid/103219
- http://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txt
- https://access.redhat.com/security/cve/CVE-2017-12627
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365
- https://lists.debian.org/debian-lts-announce/2018/03/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-12627
- https://svn.apache.org/viewvc?view=revision&revision=1819998