USN-6590-1: Xerces-C++ vulnerabilities
It was discovered that Xerces-C++ was not properly handling memory management operations when parsing XML data containing external DTDs, which could trigger a use-after-free error. If a user or automated system were tricked into processing a specially crafted XML document, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2018-1311) It was discovered that Xerces-C++ was not properly performing bounds checks when processing XML Schema Definition files, which could lead to an out-of-bounds access via an HTTP request. If a user or automated system were tricked into processing a specially crafted XSD file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-37536)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6590-1?
The severity of USN-6590-1 is considered important due to the potential for a use-after-free error when parsing specially crafted XML.
How do I fix USN-6590-1?
To fix USN-6590-1, update the affected packages to the recommended versions: 3.2.3+debian-3ubuntu0.1 for Ubuntu 22.04 or 3.2.2+debian-1ubuntu0.2 for Ubuntu 20.04.
What versions of Ubuntu are affected by USN-6590-1?
USN-6590-1 affects Ubuntu versions 16.04, 18.04, 20.04, and 22.04.
What software packages are impacted by USN-6590-1?
The impacted software packages include libxerces-c3.2 and libxerces-c-samples in various versions.
Is there a known exploit for USN-6590-1?
While there is no specific exploit publicly available for USN-6590-1, the vulnerability can potentially be exploited by processing malicious XML files.