CVE-2015-0252: apache xerces-c\+\+ Improper Input Validation

EPSS trend

Probability

39.69%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 39.69% on 18-09-2026

18-09-202618-10-2026

EPSS score

39.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasedoslinuxUnverified
Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC)
Maturity: poc

References

31 links

www.debian.org/security/2015/dsa-3199Vendor AdvisoryX Refsource DEBIAN
www.securityfocus.com/bid/73252VDB EntryX Refsource BID
lists.fedoraproject.org/pipermail/package-announce/2015-March/152882.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2015-March/153887.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2015-March/153903.htmlVendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-updates/2016-04/msg00012.htmlVendor AdvisoryX Refsource SUSE
lists.fedoraproject.org/pipermail/package-announce/2015-March/153829.htmlVendor AdvisoryX Refsource FEDORA
rhn.redhat.com/errata/RHSA-2015-1193.htmlVendor AdvisoryX Refsource REDHAT
lists.fedoraproject.org/pipermail/package-announce/2015-March/153094.htmlVendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/pipermail/package-announce/2015-March/153923.htmlVendor AdvisoryX Refsource FEDORA

Show all 31 references

packetstormsecurity.com/files/131756/Apache-Xerces-C-XML-Parser-Denial-Of-Service.htmlX Refsource MISC
xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txtX Refsource CONFIRMVendor AdvisoryAdvisoryARTICLEREPORT
www.securitytracker.com/id/1032254VDB EntryX Refsource SECTRACK
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRM
www.exploit-db.com/exploits/36906/ExploitX Refsource EXPLOIT DB
shibboleth.net/community/advisories/secadv_20150319.txtX Refsource CONFIRM
advisories.mageia.org/MGASA-2015-0136.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=15538REPORT
www.debian.org/security/2015/dsa-3199WEB
www.suse.com/support/update/announcement/2015/suse-su-20150597-1/Advisory
bugzilla.suse.com/920810REPORT
www.suse.com/security/cve/CVE-2015-0252WEB
access.redhat.com/errata/RHSA-2015:1193Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1199103REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1193.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-0252REPORT
www.cve.org/CVERecord?id=CVE-2015-0252AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2015-0252Advisory
ubuntu.com/security/CVE-2015-0252REPORT
security-tracker.debian.org/tracker/CVE-2015-0252Advisory

Related vulnerabilities

CVE-2018-1111fedoradhcp+1497.86%8y ago17-05-2018 16:00DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.CVE-2018-1311apache software foundationapache xerces-c+529.50%6y ago18-12-2019 00:00The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.CVE-2018-19200debianuriparser+32.48%7y ago12-11-2018 15:00An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.CVE-2018-7262fedoraprojectfedora+282.87%8y ago19-03-2018 21:00In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.CVE-2018-5730debiankrb5+72.24%8y ago06-03-2018 20:00MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.CVE-2018-5729debiankrb5+72.58%8y ago06-03-2018 20:00MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.

All vulnerabilities inxerces-c\+\+debian_linux fedora

CVE-2015-0252: apache xerces-c\+\+ Improper Input Validation

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References