Xerces-C XML Parser External DTD Reference Handling NULL Pointer Dereference
Summary
DLA-1328-1: xerces-c - security update. Affects xerces-c versions < 3.1.1-3+deb7u5. Fixed in 3.1.1-3+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xerces-C is an open-source XML parser library written in C++. It provides functionality for parsing, validating, and manipulating XML documents. The library is widely used in various applications and frameworks that require XML processing. However, a vulnerability has been discovered in Xerces-C that affects its handling of external Document Type Definition (DTD) references.
Vulnerability Detail
The vulnerability in Xerces-C arises from a mishandling of certain types of external DTD references. When processing the path to the DTD, the parser dereferences a NULL pointer, leading to a denial of service (DoS) attack. This vulnerability can be exploited in applications that allow DTD processing and do not prevent external DTD usage. In some cases, it may even result in remote code execution.
How To Fix
Minimum fixed version
3.1.1-3+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xerces-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided security update to mitigate the risk of exploitation.
Conclusion
The Xerces-C XML parser is vulnerable to a NULL pointer dereference issue when handling certain external DTD references. This vulnerability can lead to denial of service attacks and potentially remote code execution. Users are advised to update their xerces-c packages to the fixed version as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xerces-c →
FAQ
Xerces-C is an open-source XML parser library written in C++. It is widely used for parsing, validating, and manipulating XML documents.
A NULL pointer dereference occurs when a program attempts to access or dereference a memory address that is NULL (i.e., does not point to any valid memory location). This can lead to crashes, DoS attacks, or even remote code execution.
Applications that allow DTD processing and do not prevent external DTD usage are vulnerable to this issue. Attackers can exploit the vulnerability to cause a denial of service or potentially execute arbitrary code remotely.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided security update to protect against exploitation.
To update the xerces-c package, you can use the package manager specific to your operating system. For Debian 7 Wheezy, the recommended command is 'apt-get update && apt-get install xerces-c'.
Related vulnerabilities
Recent vulnerabilities recorded for xerces-c.
