CVE-2015-0252

Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC)

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.

internal/XMLReader.cpp en Apache Xerces-C anterior a 3.1.2 permite a atacantes remotos causar una denegación de servicio (fallo de segmentación y caída) a través de datos XML manipulados.

A flaw was found in the way the Xerces-C XML parser processed certain XML documents. A remote attacker could provide specially crafted XML input that, when parsed by an application using Xerces-C, would cause that application to crash.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-11-18 CVE Reserved
2015-03-21 CVE Published
2024-08-06 CVE Updated
2024-08-06 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (18)

URL	Tag	Source
http://packetstormsecurity.com/files/131756/Apache-Xerces-C-XML-Parser-Denial-Of-Service.html	X_refsource_misc
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	X_refsource_confirm
http://www.securityfocus.com/bid/73252	Vdb Entry
http://www.securitytracker.com/id/1032254	Vdb Entry
https://shibboleth.net/community/advisories/secadv_20150319.txt	X_refsource_confirm

URL	Date	SRC
https://www.exploit-db.com/exploits/36906	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152882.html	2023-02-05
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153094.html	2023-02-05
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153829.html	2023-02-05
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153887.html	2023-02-05
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153903.html	2023-02-05
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153923.html	2023-02-05
http://lists.opensuse.org/opensuse-updates/2016-04/msg00012.html	2023-02-05
http://rhn.redhat.com/errata/RHSA-2015-1193.html	2023-02-05
http://www.debian.org/security/2015/dsa-3199	2023-02-05
http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt	2023-02-05
https://access.redhat.com/security/cve/CVE-2015-0252	2015-06-29
https://bugzilla.redhat.com/show_bug.cgi?id=1199103	2015-06-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				7.1 Search vendor "Debian" for product "Debian Linux" and version "7.1"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				20 Search vendor "Fedoraproject" for product "Fedora" and version "20"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				21 Search vendor "Fedoraproject" for product "Fedora" and version "21"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				22 Search vendor "Fedoraproject" for product "Fedora" and version "22"		-		Affected
Apache Search vendor "Apache"		Xerces-c\+\+ Search vendor "Apache" for product "Xerces-c\+\+"				<= 3.1.1 Search vendor "Apache" for product "Xerces-c\+\+" and version " <= 3.1.1"		-		Affected