{"api_version":"1","generated_at":"2026-04-23T09:39:09+00:00","cve":"CVE-2018-1311","urls":{"html":"https://cve.report/CVE-2018-1311","api":"https://cve.report/api/cve/CVE-2018-1311.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1311","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1311"},"summary":{"title":"CVE-2018-1311","description":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2019-12-18 20:15:00","updated_at":"2023-12-31 14:15:00"},"problem_types":["CWE-416"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b@%3Cc-dev.xerces.apache.org%3E","name":"[xerces-c-dev] 20200110 [xerces-c] 06/13: Add CVE-2018-1311 advisory and web site note.","refsource":"MLIST","tags":["Mitigation","Third Party Advisory"],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2020/dsa-4814","name":"DSA-4814","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-4814-1 xerces-c","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 RE: Security vulnerability - CVE-2018-1311","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2020:0704","name":"RHSA-2020:0704","refsource":"REDHAT","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/","name":"FEDORA-2023-817ecc703f","refsource":"","tags":[],"title":"","mime":"","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3E","name":"[xerces-c-dev] 20200110 [xerces-c] 06/13: Add CVE-2018-1311 advisory and web site note.","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/","name":"FEDORA-2023-52ba628e03","refsource":"","tags":[],"title":"","mime":"","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35@%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 Re: Security vulnerability - CVE-2018-1311","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html","name":"[debian-lts-announce] 20201217 [SECURITY] [DLA 2498-1] xerces-c security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2498-1] xerces-c security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","name":"https://www.oracle.com/security-alerts/cpujan2022.html","refsource":"MISC","tags":[],"title":"Oracle Critical Patch Update Advisory - January 2022","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://marc.info/?l=xerces-c-users&m=157653840106914&w=2","name":"https://marc.info/?l=xerces-c-users&m=157653840106914&w=2","refsource":"CONFIRM","tags":["Mailing List","Third Party Advisory"],"title":"'Xerces-C Security Advisory [CVE-2018-1311]' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html","name":"[debian-lts-announce] 20231231 [SECURITY] [DLA 3704-1] xerces-c security update","refsource":"","tags":[],"title":"","mime":"","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 Security vulnerability - CVE-2018-1311","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625@%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 RE: Security vulnerability - CVE-2018-1311","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/errata/RHSA-2020:0702","name":"RHSA-2020:0702","refsource":"REDHAT","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 Re: Security vulnerability - CVE-2018-1311","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646@%3Cc-users.xerces.apache.org%3E","name":"[xerces-c-users] 20210528 Security vulnerability - CVE-2018-1311","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1311","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1311","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"3.2.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"xerces-c","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"3.2.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"xerces-c","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"3.2.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"xerces-c\\+\\+","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"goldengate","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_desktop","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_desktop","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_eus","cpe6":"7.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server_aus","cpe6":"7.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_server_tus","cpe6":"7.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_workstation","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1311","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"redhat","cpe5":"enterprise_linux_workstation","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2018-1311","qid":"200042","title":"Ubuntu Security Notification for Xerces-C++ Vulnerability (USN-6579-1)"},{"cve":"CVE-2018-1311","qid":"200052","title":"Ubuntu Security Notification for Xerces-C++ Vulnerability (USN-6579-2)"},{"cve":"CVE-2018-1311","qid":"200056","title":"Ubuntu Security Notification for Xerces-C++ Vulnerabilities (USN-6590-1)"},{"cve":"CVE-2018-1311","qid":"284841","title":"Fedora Security Update for xerces (FEDORA-2023-52ba628e03)"},{"cve":"CVE-2018-1311","qid":"285073","title":"Fedora Security Update for xerces (FEDORA-2023-817ecc703f)"},{"cve":"CVE-2018-1311","qid":"375422","title":"IBM Integration Bus and IBM App Connect Enterprise Apache Xerces denial of service Vulnerability(6406232)"},{"cve":"CVE-2018-1311","qid":"377016","title":"Alibaba Cloud Linux Security Update for xerces-c (ALINUX2-SA-2020:0027)"},{"cve":"CVE-2018-1311","qid":"506277","title":"Alpine Linux Security Update for xerces-c"},{"cve":"CVE-2018-1311","qid":"6000416","title":"Debian Security Update for xerces-c (DLA 3704-1)"},{"cve":"CVE-2018-1311","qid":"670213","title":"EulerOS Security Update for xerces-c (EulerOS-SA-2021-1862)"},{"cve":"CVE-2018-1311","qid":"751082","title":"SUSE Enterprise Linux Security Update for xerces-c (SUSE-SU-2021:2920-1)"},{"cve":"CVE-2018-1311","qid":"751088","title":"SUSE Enterprise Linux Security Update for xerces-c (SUSE-SU-2021:2944-1)"},{"cve":"CVE-2018-1311","qid":"751104","title":"OpenSUSE Security Update for xerces-c (openSUSE-SU-2021:1231-1)"},{"cve":"CVE-2018-1311","qid":"751105","title":"OpenSUSE Security Update for xerces-c (openSUSE-SU-2021:2958-1)"},{"cve":"CVE-2018-1311","qid":"755688","title":"SUSE Enterprise Linux Security Update for xerces-c (SUSE-SU-2024:0300-1)"},{"cve":"CVE-2018-1311","qid":"755689","title":"SUSE Enterprise Linux Security Update for xerces-c (SUSE-SU-2024:0299-1)"},{"cve":"CVE-2018-1311","qid":"755696","title":"SUSE Enterprise Linux Security Update for xerces-c (SUSE-SU-2024:0320-1)"},{"cve":"CVE-2018-1311","qid":"900790","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for xerces-c (9201)"},{"cve":"CVE-2018-1311","qid":"901349","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for xerces-c (9201-1)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2018-1311","ASSIGNER":"security@apache.org","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Apache Software Foundation","product":{"product_data":[{"product_name":"Apache Xerces-C","version":{"version_data":[{"version_value":"3.0.0 to 3.2.2"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Denial of Service and Remote Exploit"}]}]},"references":{"reference_data":[{"refsource":"MLIST","name":"[xerces-c-dev] 20200110 [xerces-c] 06/13: Add CVE-2018-1311 advisory and web site note.","url":"https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b@%3Cc-dev.xerces.apache.org%3E"},{"refsource":"REDHAT","name":"RHSA-2020:0704","url":"https://access.redhat.com/errata/RHSA-2020:0704"},{"refsource":"REDHAT","name":"RHSA-2020:0702","url":"https://access.redhat.com/errata/RHSA-2020:0702"},{"refsource":"MLIST","name":"[debian-lts-announce] 20201217 [SECURITY] [DLA 2498-1] xerces-c security update","url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html"},{"refsource":"DEBIAN","name":"DSA-4814","url":"https://www.debian.org/security/2020/dsa-4814"},{"refsource":"MLIST","name":"[xerces-c-users] 20210528 Security vulnerability - CVE-2018-1311","url":"https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646@%3Cc-users.xerces.apache.org%3E"},{"refsource":"MLIST","name":"[xerces-c-users] 20210528 RE: Security vulnerability - CVE-2018-1311","url":"https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625@%3Cc-users.xerces.apache.org%3E"},{"refsource":"MLIST","name":"[xerces-c-users] 20210528 Re: Security vulnerability - CVE-2018-1311","url":"https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35@%3Cc-users.xerces.apache.org%3E"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","refsource":"MISC","name":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"refsource":"CONFIRM","name":"https://marc.info/?l=xerces-c-users&m=157653840106914&w=2","url":"https://marc.info/?l=xerces-c-users&m=157653840106914&w=2"}]},"description":{"description_data":[{"lang":"eng","value":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable."}]}},"nvd":{"publishedDate":"2019-12-18 20:15:00","lastModifiedDate":"2023-12-31 14:15:00","problem_types":["CWE-416"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:xerces-c\\+\\+:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndIncluding":"3.2.3","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:*","versionEndExcluding":"21.4.0.0.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1311","Ordinal":"116627","Title":"CVE-2018-1311","CVE":"CVE-2018-1311","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1311","Ordinal":"1","NoteData":"The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1311","Ordinal":"2","NoteData":"2019-12-18","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1311","Ordinal":"3","NoteData":"2022-02-07","Type":"Other","Title":"Modified"}]}}}