CVE-2024-23807: Apache Xerces C++: Use-after-free on external DTD scan
Apache Xerces C++ XML parser could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw during the scanning of external DTDs. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23807?
CVE-2024-23807 has a high severity rating, allowing remote code execution due to a use-after-free flaw in Apache Xerces C++.
What software is affected by CVE-2024-23807?
CVE-2024-23807 affects Apache Xerces-C++ versions 3.0.0 to 3.2.5 and IBM Spectrum Protect for Virtual Environments versions up to 8.1.22.0.
How do I fix CVE-2024-23807?
To fix CVE-2024-23807, upgrade Apache Xerces-C++ to version 3.2.6 or later, or apply patches provided by relevant vendors.
What could an attacker do by exploiting CVE-2024-23807?
An attacker exploiting CVE-2024-23807 could execute arbitrary code on the system by sending specially crafted requests.
Is there a known workaround for CVE-2024-23807?
No specific workarounds are documented for CVE-2024-23807, and the recommended action is to upgrade or patch the affected software.