CVE-2018-1311 Use after free in Apache Xerces-C
A use-after-free flaw in Apache Xerces-C allows attackers to cause denial of service or execute code via malicious external DTDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1311?
CVE-2018-1311 is a high-severity use after free vulnerability in Debian Debian Linux, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
Weakness: CWE-416
Which versions are affected by CVE-2018-1311?
It affects 10 products.
Linux distribution packages (40)
xerces-c Red Hat:enterprise_linux:6::client | All versions | 0:3.0.1-21.el6_10 |
xerces-c-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:3.0.1-21.el6_10 |
xerces-c-devel Red Hat:enterprise_linux:6::client | All versions | 0:3.0.1-21.el6_10 |
xerces-c-doc Red Hat:enterprise_linux:6::client | All versions | 0:3.0.1-21.el6_10 |
xerces-c Red Hat:enterprise_linux:6::computenode | All versions | 0:3.0.1-21.el6_10 |
xerces-c-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:3.0.1-21.el6_10 |
xerces-c-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:3.0.1-21.el6_10 |
xerces-c-doc Red Hat:enterprise_linux:6::computenode | All versions | 0:3.0.1-21.el6_10 |
xerces-c Red Hat:enterprise_linux:6::server | All versions | 0:3.0.1-21.el6_10 |
xerces-c-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:3.0.1-21.el6_10 |
xerces-c-devel Red Hat:enterprise_linux:6::server | All versions | 0:3.0.1-21.el6_10 |
xerces-c-doc Red Hat:enterprise_linux:6::server | All versions | 0:3.0.1-21.el6_10 |
xerces-c Red Hat:enterprise_linux:6::workstation | All versions | 0:3.0.1-21.el6_10 |
xerces-c-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:3.0.1-21.el6_10 |
xerces-c-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:3.0.1-21.el6_10 |
xerces-c-doc Red Hat:enterprise_linux:6::workstation | All versions | 0:3.0.1-21.el6_10 |
xerces-c Red Hat:enterprise_linux:7::client | All versions | 0:3.1.1-10.el7_7 |
xerces-c-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:3.1.1-10.el7_7 |
xerces-c-devel Red Hat:enterprise_linux:7::client | All versions | 0:3.1.1-10.el7_7 |
xerces-c-doc Red Hat:enterprise_linux:7::client | All versions | 0:3.1.1-10.el7_7 |
xerces-c Red Hat:enterprise_linux:7::computenode | All versions | 0:3.1.1-10.el7_7 |
xerces-c-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:3.1.1-10.el7_7 |
xerces-c-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:3.1.1-10.el7_7 |
xerces-c-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:3.1.1-10.el7_7 |
xerces-c Red Hat:enterprise_linux:7::server | All versions | 0:3.1.1-10.el7_7 |
xerces-c-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:3.1.1-10.el7_7 |
xerces-c-devel Red Hat:enterprise_linux:7::server | All versions | 0:3.1.1-10.el7_7 |
xerces-c-doc Red Hat:enterprise_linux:7::server | All versions | 0:3.1.1-10.el7_7 |
xerces-c Red Hat:enterprise_linux:7::workstation | All versions | 0:3.1.1-10.el7_7 |
xerces-c-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:3.1.1-10.el7_7 |
xerces-c-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:3.1.1-10.el7_7 |
xerces-c-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:3.1.1-10.el7_7 |
xerces-c SUSE:Enterprise Storage 6 | All versions | 3.1.4-3.6.1 |
xerces-c SUSE:Enterprise Storage 7.1 | All versions | 3.1.4-150200.10.11.1 |
xerces-c SUSE:Enterprise Storage 7.1 | All versions | 3.2.3-150300.3.6.1 |
xerces-c SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 3.1.4-3.6.1 |
xerces-c SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 3.1.4-3.6.1 |
xerces-c SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 3.1.4-150200.10.11.1 |
xerces-c SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.1.4-150200.10.11.1 |
xerces-c SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 3.2.3-150300.3.6.1 |
Products include Apache Xerces-C\+\+, Debian Debian Linux, Fedoraproject Fedora, Oracle Goldengate, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus and 4 more.
How do I fix CVE-2018-1311?
Apply a workaround.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-1311 being exploited?
There is no known exploitation of CVE-2018-1311 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-1311, DLA-2498-1, DSA-4814-1, ECHO-8795-b753-f167, GHSA-7rpp-hwhj-9hv8, MGASA-2020-0296 and 20 more.