CVE-2015-0252 internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
MediumCVSS 5.0
EPSS 38.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xerces-c(Debian:12) | < 3.1.1-5.1 | 3.1.1-5.1 |
| debian/xerces-c(Debian:13) | < 3.1.1-5.1 | 3.1.1-5.1 |
| debian/xerces-c(Debian:14) | < 3.1.1-5.1 | 3.1.1-5.1 |
| debian linux | = 7.1 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| apache xerces-c++ | <= 3.1.1 | No fix listed |
References
- Debian Security Tracker CVE-2015-0252 vendor-advisory
- bugs.debian.org issue-tracking
- FEDORA-2015-4226 vendor-advisory
- FEDORA-2015-4272 vendor-advisory
- FEDORA-2015-4251 vendor-advisory
- FEDORA-2015-4228 vendor-advisory
- FEDORA-2015-4321 vendor-advisory
- FEDORA-2015-4285 vendor-advisory
- openSUSE-SU-2016:0966 vendor-advisory
- packetstormsecurity.com
- RHSA-2015:1193 vendor-advisory
- DSA-3199 vendor-advisory
- www.oracle.com
- 73252 vdb-entry
- 1032254 vdb-entry
- xerces.apache.org vendor-advisory
- shibboleth.net
- 36906 exploit