You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@xerces.apache.org by sc...@apache.org on 2019/12/16 23:08:02 UTC
svn commit: r1871684 - in /xerces/site/trunk/production/xerces-c: secadv.html secadv/CVE-2018-1311.txt

Author: scantor
Date: Mon Dec 16 23:08:02 2019
New Revision: 1871684

URL: http://svn.apache.org/viewvc?rev=1871684&view=rev
Log:
Add CVE-2018-1311 advisory and web site note.

Added:
    xerces/site/trunk/production/xerces-c/secadv/CVE-2018-1311.txt
Modified:
    xerces/site/trunk/production/xerces-c/secadv.html

Modified: xerces/site/trunk/production/xerces-c/secadv.html
URL: http://svn.apache.org/viewvc/xerces/site/trunk/production/xerces-c/secadv.html?rev=1871684&r1=1871683&r2=1871684&view=diff
==============================================================================
--- xerces/site/trunk/production/xerces-c/secadv.html (original)
+++ xerces/site/trunk/production/xerces-c/secadv.html Mon Dec 16 23:08:02 2019
@@ -69,6 +69,17 @@
 
 <IMG border="0" height="14" hspace="0" src="resources/close.gif" vspace="0" width="120"><BR></TD><TD align="left" valign="top" width="500"><TABLE border="0" cellpadding="3" cellspacing="0"><TR><TD>
 
+<TABLE border="0" cellpadding="0" cellspacing="0" width="494"><TR><TD bgcolor="ffffff" colspan="2" width="494"><TABLE border="0" cellpadding="0" cellspacing="0" width="494"><TR><TD bgcolor="#039acc" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#039acc" height="1" width="492"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="492"></TD><TD bgcolor="#0086b2" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD></TR><TR><TD bgcolor="#039acc" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#0086b2" width="492"><FONT color="#ffffff" face="arial,helvetica,sanserif" size="+1"><IMG border="0" height="2" hspace="0" src="resources/void.gif" vspace="0" width="2"><B>Unaddressed Advisories</B></FONT></TD><TD bgcolor="#017299" width="1"><IMG border="0" height="1" hspace="
 0" src="resources/void.gif" vspace="0" width="1"></TD></TR><TR><TD bgcolor="#0086b2" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#017299" height="1" width="492"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="492"></TD><TD bgcolor="#017299" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD></TR></TABLE></TD></TR><TR><TD width="10">&nbsp;</TD><TD width="484"><FONT color="#000000" face="arial,helvetica,sanserif">
+
+<P>The following security advisories apply to current versions of
+Xerces-C and have not been fixed, in most cases due to insufficient
+expertise or resources:</P>
+
+<UL>
+  <LI><A href="secadv/CVE-2018-1311.txt">CVE-2018-1311: Apache Xerces-C use-after-free vulnerability scanning external DTD</A></LI>
+</UL>
+</FONT></TD></TR></TABLE><BR>
+
 <TABLE border="0" cellpadding="0" cellspacing="0" width="494"><TR><TD bgcolor="ffffff" colspan="2" width="494"><TABLE border="0" cellpadding="0" cellspacing="0" width="494"><TR><TD bgcolor="#039acc" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#039acc" height="1" width="492"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="492"></TD><TD bgcolor="#0086b2" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD></TR><TR><TD bgcolor="#039acc" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#0086b2" width="492"><FONT color="#ffffff" face="arial,helvetica,sanserif" size="+1"><IMG border="0" height="2" hspace="0" src="resources/void.gif" vspace="0" width="2"><B>Addressed in 3.2.1 and Later Releases</B></FONT></TD><TD bgcolor="#017299" width="1"><IMG border="0" heig
 ht="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD></TR><TR><TD bgcolor="#0086b2" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD><TD bgcolor="#017299" height="1" width="492"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="492"></TD><TD bgcolor="#017299" height="1" width="1"><IMG border="0" height="1" hspace="0" src="resources/void.gif" vspace="0" width="1"></TD></TR></TABLE></TD></TR><TR><TD width="10">&nbsp;</TD><TD width="484"><FONT color="#000000" face="arial,helvetica,sanserif">
 <P>The following security advisories apply to versions of
 Xerces-C older than V3.2.1:</P>

Added: xerces/site/trunk/production/xerces-c/secadv/CVE-2018-1311.txt
URL: http://svn.apache.org/viewvc/xerces/site/trunk/production/xerces-c/secadv/CVE-2018-1311.txt?rev=1871684&view=auto
==============================================================================
--- xerces/site/trunk/production/xerces-c/secadv/CVE-2018-1311.txt (added)
+++ xerces/site/trunk/production/xerces-c/secadv/CVE-2018-1311.txt Mon Dec 16 23:08:02 2019
@@ -0,0 +1,49 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+CVE-2018-1311: Apache Xerces-C use-after-free vulnerability processing external DTD
+
+Severity: High
+
+Vendor: The Apache Software Foundation
+
+Versions Affected: Apache Xerces-C XML Parser library (all known versions)
+
+Description: The Xerces-C XML parser contains a use-after-free error
+triggered during the scanning of external DTDs.
+
+The bug allows for a denial of service attack in applications that allow
+external DTD processing and do not prevent external DTD usage, and could
+conceivably result in remote code execution if the heap were groomed.
+
+Mitigation: This flaw has not been addressed in the maintained version
+of the library and has no current mitigation other than to disable DTD
+processing. This can be accomplished via the DOM using a standard parser
+feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
+
+Applications should strongly consider blocking remote entity resolution
+and/or disabling of DTD processing in light of the continued
+identification of bugs in this area of the library.
+
+Credit: This issue was reported by the UK's National Cyber Security
+Centre (NCSC).
+
+References:
+http://xerces.apache.org/xerces-c/secadv/CVE-2018-1311.txt
+
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAl34DFIACgkQN4uEVAIn
+eWIbtQ/9Gv7gURR24J5yx+R69O4bnGsgHPaHea7VWh4bs4H/mYli3ewZBwzkuTz1
++Ib6RN8QXT9FA4+TVBCQua2/EBlpnpNMHPp6+GDWISrPYworJGV9FDrCDfqB+BR2
+Li68pH/wlFgqCLMsdUSm7lKU9n+rflW8kx3AsqBlggcrfGTh7XJaImHelOXuRqw/
+QumnckDQQkEgPHxGVE5h2uYvwj1HsyU/czqqWVAHC1rzdXI9syGGOO9xoNCjB70d
+rMi+XEDTuyzqY6SIjM1NLbFyX8cs9CDM4IhQeG+XNQUE9VnvLu1dHY/IqvS9jDrO
+HD4J0ID/rnbxSou3BTaMKGr/TkJHanniZhXJxZujDI7ksEbMBemB7ROwCcQLQ8Z8
+B3QKfCQwjIGmBMaDafElyrbIp74+Vpq3eY6itFOGCQE7f+rXu3qxEk5njsdBsJYV
+s47v9f0v65O0FE5l7yPi3zhkonCfHaMTw08SboY2YqWJf9A1YJZOs1PF1SNU+D/p
+rM2ydwP5F9OPlwm/uLCfRd+hl2etM0UJBcL1V/tP0ORoEZUF1+ZEZckDQ9Cnr2eY
+6Dgd+dmTk5nxjPmsQZPHb4QXsQHbq1HCU5/oJug56SatJ0H0ffj48XXjd1UlBEIk
+v5Eo3+ahPxXBuSgc77naLcisSy3H3+qL6VDMpq6qK1IC/PXvaz0=
+=zDeT
+-----END PGP SIGNATURE-----



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@xerces.apache.org
For additional commands, e-mail: commits-help@xerces.apache.org