PT-2024-1816 · Apache+1 · Apache Xerces-C+1

Arnout Engelen · Published 2024-02-16 · Updated 2025-03-06 · CVE-2024-23807

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Xerces C++ XML parser versions 3.0.0 through 3.2.5

Description The issue is related to a use-after-free error triggered during the scanning of external DTDs. This can allow a remote attacker to execute arbitrary code. Users can mitigate the issue by disabling DTD processing, which can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES DISABLE DTD environment variable.

Recommendations To resolve the issue, upgrade to version 3.2.5, which fixes the problem. As a temporary workaround, consider disabling DTD processing via the DOM using a standard parser feature, or via SAX using the XERCES DISABLE DTD environment variable.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2023-8427

ALT-PU-2024-8078

ALT-PU-2025-3748

AZL-55883

AZL-55898

BDU:2024-01559

CVE-2024-23807

Affected Products

Alt Linux

Apache Xerces-C

References · 15

• 🔥 https://github.com/apache/xerces-c/pull/54 · Exploit
• https://lists.apache.org/thread/c497tgn864tsbm8w0bo3f0d81s07zk9r · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23807 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23807 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23807 · Security Note
• https://osv.dev/vulnerability/AZL-55883 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23807 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23807 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-55898 · Vendor Advisory
• https://github.com/apache/xerces-c/commit/e0024267504188e42ace4dd9031d936786914835 · Note
• https://twitter.com/VulmonFeeds/status/1758538425605443748 · Twitter Post
• https://issues.apache.org/jira/browse/XERCESC-2188 · Note
• https://t.me/cvenotify/107648 · Telegram Post
• https://twitter.com/CVEnew/status/1762847238642958572 · Twitter Post