High severity8.1NVD Advisory· Published Dec 18, 2019· Updated Jun 17, 2026

CVE-2018-1311

Description

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Xerces C\+\+3 versions
cpe:2.3:a:apache:xerces-c\+\+:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:xerces-c\+\+:*:*:*:*:*:*:*:*range: >=3.0.0,<3.2.5
- (no CPE)range: 3.0.0-3.2.3
- (no CPE)range: 3.0.0 to 3.2.2
Oracle Corporation/Goldengate
cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*
Range: <21.4.0.0.0
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
osv-coords35 versions
pkg:rpm/opensuse/xerces-c&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/xerces-c&distro=openSUSE%20Leap%2015.3 pkg:rpm/opensuse/xerces-c&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/xerces-c&distro=openSUSE%20Tumbleweed pkg:rpm/suse/xerces-c&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/xerces-c&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/xerces-c&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/xerces-c&distro=SUSE%20Manager%20Proxy%204.0 pkg:rpm/suse/xerces-c&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/xerces-c&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0 pkg:rpm/suse/xerces-c&distro=SUSE%20Manager%20Server%204.0 pkg:rpm/suse/xerces-c&distro=SUSE%20Manager%20Server%204.3
< 3.1.4-lp152.5.3.1+ 34 more
- (no CPE)range: < 3.1.4-lp152.5.3.1
- (no CPE)range: < 3.1.4-10.3.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.2.5-1.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-150200.10.11.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-10.3.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.1-13.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-150200.10.11.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.1-13.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-150200.10.11.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.1-13.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.1.4-3.6.1
- (no CPE)range: < 3.2.3-150300.3.6.1

Patches

Vulnerability mechanics

References

www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party Advisory
www.openwall.com/lists/oss-security/2024/02/16/1nvdMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2020:0702nvdThird Party Advisory
access.redhat.com/errata/RHSA-2020:0704nvdThird Party Advisory
lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3EnvdVendor Advisory
lists.debian.org/debian-lts-announce/2020/12/msg00025.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2023/12/msg00027.htmlnvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/nvdMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/nvdMailing ListThird Party Advisory
marc.infonvdMailing ListThird Party Advisory
www.debian.org/security/2020/dsa-4814nvdThird Party Advisory
lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3EnvdIssue Tracking
lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3EnvdIssue Tracking
lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3EnvdIssue Tracking
lists.fedoraproject.org/archives/list/[email protected]/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/nvd

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.008
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000