An updated xerces-c package that fixes one security issue is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Xerces-C is a validating XML parser written in a portable subset of C++.

A flaw was found in the way the Xerces-C XML parser processed certain XML documents. A remote attacker could provide specially crafted XML input that, when parsed by an application using Xerces-C, would cause that application to crash. (CVE-2015-0252)

All xerces-c users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

A flaw was found in the way the Xerces-C XML parser processed certain XML documents. A remote attacker could provide specially crafted XML input that, when parsed by an application using Xerces-C, would cause that application to crash. (CVE-2015-0252)

This update for xerces-c fixes the following security issues :

  - CVE-2016-0729: Fix for mishandling certain kinds of     malformed input documents, resulting in buffer overlows     during processing and error reporting. The overflows can     manifest as a segmentation fault or as memory corruption     during a parse operation. (boo#966822)

  - CVE-2015-0252: Fix for mishandling certain kinds of     malformed input documents, resulting in a segmentation     fault during a parse operation (boo#920810)

Update to xerces-c 3.1.2, fixing CVE-2015-0252.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c, a validating XML parser library for C++.
The parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. An unauthenticated attacker could use this flaw to cause an application using the xerces-c library to crash.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-0252.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1193 advisory.

    [3.1.1-7]     Resolves: rhbz#1217104 CVE-2015-0252

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-223:01 advisory.

    Xerces-C is a validating XML parser written in a portable     subset of C  . Xerces-C makes it easy to give your application the     ability to read and write XML data. A shared library is provided for     parsing, generating, manipulating, and validating XML     documents. Xerces-C is faithful to the XML 1.0 recommendation and     associated standards: XML 1.0 (Third Edition), XML 1.1 (First     Edition), DOM Level 1, 2, 3 Core, DOM Level 2.0 Traversal and Range,     DOM Level 3.0 Load and Save, SAX 1.0 and SAX 2.0, Namespaces in XML,     Namespaces in XML 1.1, XML Schema, XML Inclusions).
    Security issues fixed with this release:
    CVE-2015-0252

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of     service (segmentation fault and crash) via crafted XML data. (CVE-2015-0252)

Note that Nessus relies on the presence of the package as reported by the vendor.

Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c, a validating XML parser library for C++.
The parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. An unauthenticated attacker could use this flaw to cause an application using the xerces-c library to crash.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
84445	CentOS 7 : xerces-c (CESA-2015:1193)	Nessus	CentOS Local Security Checks	2015/6/30	2021/1/4	medium
84541	Scientific Linux Security Update : xerces-c on SL7.x x86_64 (20150629)	Nessus	Scientific Linux Local Security Checks	2015/7/6	2021/1/14	medium
90418	openSUSE Security Update : xerces-c (openSUSE-2016-429)	Nessus	SuSE Local Security Checks	2016/4/8	2021/1/19	critical
82285	Fedora 22 : mingw-xerces-c-3.1.2-1.fc22 (2015-4272)	Nessus	Fedora Local Security Checks	2015/3/27	2021/1/11	medium
82298	Debian DLA-181-1 : xerces-c security update	Nessus	Debian Local Security Checks	2015/3/30	2021/1/11	medium
84465	RHEL 7 : xerces-c (RHSA-2015:1193)	Nessus	Red Hat Local Security Checks	2015/6/30	2021/2/5	medium
82282	Fedora 22 : xerces-c-3.1.2-1.fc22 (2015-4226)	Nessus	Fedora Local Security Checks	2015/3/27	2021/1/11	medium
82434	Fedora 20 : mingw-xerces-c-3.1.1-9.fc20 (2015-4228)	Nessus	Fedora Local Security Checks	2015/3/31	2021/1/11	medium
84463	Oracle Linux 7 : xerces-c (ELSA-2015-1193)	Nessus	Oracle Linux Local Security Checks	2015/6/30	2024/11/1	high
290056	MiracleLinux 7 : xerces-c-3.1.1-7.el7 (AXSA:2015-223:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
82437	Fedora 20 : xerces-c-3.1.1-6.fc20 (2015-4285)	Nessus	Fedora Local Security Checks	2015/3/31	2021/1/11	medium
82439	Fedora 21 : mingw-xerces-c-3.1.1-11.fc21 (2015-4321)	Nessus	Fedora Local Security Checks	2015/3/31	2021/1/11	medium
218583	Linux Distros Unpatched Vulnerability : CVE-2015-0252	Nessus	Misc.	2025/3/4	2025/9/3	high
81983	Debian DSA-3199-1 : xerces-c - security update	Nessus	Debian Local Security Checks	2015/3/23	2021/1/11	medium

检测

插件搜索

medium

medium

critical

medium

medium

medium

medium

medium

high

high

medium

medium

high

medium