Skip to main content

Use After Free

CVE-2024-23807

High
9.8/10

Summary

The Apache Xerces C++ XML parser on versions 3.0.0 through 3.2.4 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to latest version which fixes the issue or mitigate the issue by disabling "DTD" processing. This can be accomplished via the DOM using a standard parser feature, or via "SAX" using the "XERCES_DISABLE_DTD" environment variable.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-416 - Use After Free

Use-after-free (UaF) vulnerability occurs when the application is using a pointer to memory that has been freed. Any attempt to read/write to a buffer after it is de-allocated allows memory corruption, sensitive information exposure, and can potentially lead to arbitrary code execution.

References

Advisory Timeline

  • Published