CVE-2017-12627 Null dereference in Apache Xerces C++
A null pointer dereference in the Apache Xerces-C XML parser can cause a denial of service when processing external DTD paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12627?
CVE-2017-12627 is a critical vulnerability in Apache Xerces C++, published on 1 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.
Weakness: CWE-476
Which versions are affected by CVE-2017-12627?
It affects 1 product.
Linux distribution packages (19)
xerces-c SUSE:Enterprise Storage 5 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 3.1.4-3.3.25 |
xerces-c SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:OpenStack Cloud 7 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:OpenStack Cloud 8 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:OpenStack Cloud 9 | All versions | 3.1.1-13.3.6 |
xerces-c SUSE:OpenStack Cloud Crowbar 9 | All versions | 3.1.1-13.3.6 |
xerces-c openSUSE:Leap 15.0 | All versions | 3.1.4-lp150.2.3.1 |
xerces-c openSUSE:Tumbleweed | All versions | 3.2.3-1.9 |
Products include Apache Xerces-C\+\+.
How do I fix CVE-2017-12627?
Upgrade to a fixed version.
Is CVE-2017-12627 being exploited?
There is no known exploitation of CVE-2017-12627 in the wild and no public exploit code.
Other vulnerabilities in Apache Xerces C++
Sources
Also known as DEBIAN-CVE-2017-12627, DLA-1328-1, ECHO-f7b7-3730-d2a7, GHSA-rh3v-mpfh-4wwj, MGASA-2018-0158, MGASA-2018-0178 and 5 more.