Bug 1220080 (CVE-2024-23807) - VUL-0: CVE-2024-23807: xerces-c: duplicate CVE of CVE-2018-1311 to announce correct fixed-in versions
Summary: VUL-0: CVE-2024-23807: xerces-c: duplicate CVE of CVE-2018-1311 to announce c...
Status: RESOLVED FIXED
Alias: CVE-2024-23807
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/394375/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-23807:8.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-19 14:57 UTC by SMASH SMASH
Modified: 2024-05-10 14:03 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-19 14:57:29 UTC 
Posted by Arnout Engelen on Feb 16
Severity: moderate

Affected versions:

- Apache Xerces C++ 3.0.0 before 3.2.5

Description:

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the 
scanning of external DTDs.

Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD 
processing. This can be accomplished via the DOM using a standard parser feature, or via SAX...

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23807
https://seclists.org/oss-sec/2024/q1/138
https://bugzilla.redhat.com/show_bug.cgi?id=2264581
https://www.cve.org/CVERecord?id=CVE-2024-23807
http://www.openwall.com/lists/oss-security/2024/02/16/1

Patch:
https://github.com/apache/xerces-c/commit/e0024267504188e42ace4dd9031d936786914835
Comment 1 Andrea Mattiazzo 2024-02-19 15:09:34 UTC 
Following thread [0], only SUSE:SLE-15:Update/xerces-c is missing the updated patch, the other codestreams are already fixed.

[0] https://bugzilla.suse.com/show_bug.cgi?id=1159552