Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2024-23807

critical

CVE-2024-23807

xerces-c: duplicate CVE to announce correct fixed-in versions

Published Modified CWE 416
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (high), Azure Linux (high), CBL-Mariner (high), Amazon (medium), Ubuntu (medium).

Description

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 3.0xerces-c3.2.5-1.ph3
Photon OS 4.0xerces-c, xerces-c-devel3.2.5-1.ph4
Photon OS 5.0xerces-c, xerces-c-devel3.3.0-1.ph5
amazon linux 2xerces-c, xerces-c-debuginfo, xerces-c-devel and 1 more3.1.1-10.amzn2.0.2
Azure Linux 3.0xerces-c0:3.2.4-2.azl3
CBL-Mariner 2.0xerces-c0:3.2.4-2.cm2
conan::GitLab Advisory Database Communityxerces-c3.2.5
echoxerces-c-3.2.33.2.3+e1
ubuntu 16.04-ESMxerces-c3.1.3+debian-1ubuntu0.1~esm2
ubuntu 18.04-ESMxerces-c3.2.0+debian-2ubuntu0.1~esm2
ubuntu 20.04-ESMxerces-c3.2.2+debian-1ubuntu0.1
ubuntu 22.04xerces-c3.2.3+debian-3ubuntu0.1
Show all 17 entries from 12 sources
SourcePackageFixed in
Photon OS 3.0xerces-c3.2.5-1.ph3
Photon OS 4.0xerces-c3.2.5-1.ph4
Photon OS 4.0xerces-c-devel3.2.5-1.ph4
Photon OS 5.0xerces-c3.3.0-1.ph5
Photon OS 5.0xerces-c-devel3.3.0-1.ph5
amazon linux 2xerces-c3.1.1-10.amzn2.0.2
amazon linux 2xerces-c-debuginfo3.1.1-10.amzn2.0.2
amazon linux 2xerces-c-devel3.1.1-10.amzn2.0.2
amazon linux 2xerces-c-doc3.1.1-10.amzn2.0.2
Azure Linux 3.0xerces-c0:3.2.4-2.azl3
CBL-Mariner 2.0xerces-c0:3.2.4-2.cm2
conan::GitLab Advisory Database Communityxerces-c3.2.5
echoxerces-c-3.2.33.2.3+e1
ubuntu 16.04-ESMxerces-c3.1.3+debian-1ubuntu0.1~esm2
ubuntu 18.04-ESMxerces-c3.2.0+debian-2ubuntu0.1~esm2
ubuntu 20.04-ESMxerces-c3.2.2+debian-1ubuntu0.1
ubuntu 22.04xerces-c3.2.3+debian-3ubuntu0.1

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.