Denial of Service Vulnerability in xerces-c
Summary
DSA-3199-1: xerces-c - security update. Affects xerces-c versions < 3.1.1-3+deb7u1. Fixed in 3.1.1-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xerces-c is a validating XML parser library for C++. It is widely used in various applications to parse and manipulate XML documents. The library provides functionality to validate XML against specified schemas, handle XML namespaces, and perform other XML-related operations. However, a vulnerability has been discovered in xerces-c that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in xerces-c is caused by a mishandling of certain malformed input documents during a parse operation. This can result in a segmentation fault, causing the application using the library to crash. An attacker, without authentication, can exploit this flaw to crash the targeted application.
How To Fix
Minimum fixed version
3.1.1-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xerces-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the only solution.
Conclusion
The xerces-c library is vulnerable to a denial of service attack due to a mishandling of malformed input documents. Upgrading to the fixed version is necessary to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xerces-c →
FAQ
xerces-c is a validating XML parser library for C++. It is used to parse and manipulate XML documents in various applications.
The vulnerability allows an unauthenticated attacker to crash an application using the xerces-c library, leading to a denial of service.
To fix this vulnerability, upgrade the xerces-c package to version 3.1.1-3+deb7u1 or later.
No, there is no known workaround. Upgrading to the fixed version is the only solution.
You can find more information about this vulnerability in the Debian Security Advisory DSA-3199-1.
Related vulnerabilities
Recent vulnerabilities recorded for xerces-c.
