CVE-2018-1311
- State
- Published
- Severity
- Not scored
- Published
- Dec 18, 2019
- Updated
- Nov 4, 2025
- Reserved
- Dec 7, 2017
Description
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Apache Xerces-CApache Software Foundation |
|
References
- [xerces-c-dev] 20200110 [xerces-c] 06/13: Add CVE-2018-1311 advisory and web site note.mailing-list
- RHSA-2020:0704vendor-advisory
- RHSA-2020:0702vendor-advisory
- [debian-lts-announce] 20201217 [SECURITY] [DLA 2498-1] xerces-c security updatemailing-list
- DSA-4814vendor-advisory
- [xerces-c-users] 20210528 Security vulnerability - CVE-2018-1311mailing-list
- [xerces-c-users] 20210528 RE: Security vulnerability - CVE-2018-1311mailing-list
- [xerces-c-users] 20210528 Re: Security vulnerability - CVE-2018-1311mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://marc.info/?l=xerces-c-users&m=157653840106914&w=2
- FEDORA-2023-52ba628e03vendor-advisory
- FEDORA-2023-817ecc703fvendor-advisory
- [debian-lts-announce] 20231231 [SECURITY] [DLA 3704-1] xerces-c security updatemailing-list
- [oss-security] 20240216 CVE-2024-23807: Apache Xerces C++: Use-after-free on external DTD scanmailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.