VULNERABILITY INTELLIGENCE
CVE-2018-1311
CVSS score8.1 HIGH
EPSS probability9.50%
CISA KEVNot currently listed
Published2019-12-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
Weakness classification
- CWE-416: Use After Free
Primary references
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Vendor Advisory
- security@apache.org — Issue Tracking
- security@apache.org — Issue Tracking
- security@apache.org — Issue Tracking
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Mailing List, Third Party Advisory