USN-6579-2: Xerces-C++ vulnerability
USN-6579-1 fixed a vulnerability in Xerces-C++. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04 and Ubuntu 23.10. Original advisory details: It was discovered that Xerces-C++ was not properly handling memory management operations when parsing XML data containing external DTDs, which could trigger a use-after-free error. If a user or automated system were tricked into processing a specially crafted XML document, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What vulnerabilities does USN-6579-2 address?
USN-6579-2 provides updates addressing vulnerabilities in Xerces-C++ related to improper memory management.
What is the severity of USN-6579-2?
The severity of USN-6579-2 can range from moderate to high depending on the specific vulnerability it addresses.
How do I fix USN-6579-2?
To fix USN-6579-2, update the affected packages to the recommended versions specified in the advisory.
Which Ubuntu versions are affected by USN-6579-2?
USN-6579-2 affects Ubuntu 20.04 LTS, 22.04 LTS, 23.04, and 23.10.
Is there a specific package version I should upgrade to for USN-6579-2?
Yes, you should upgrade to libxerces-c3.2 version 3.2.4+debian-1ubuntu0.23.10.1 or corresponding versions for other affected releases.