The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

oracle CPUOct2024: MySQL Cluster 8.0.40

oracle CPUOct2024: MySQL Cluster 8.4.3

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (curl)). The supported version that is affected is     21.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols     to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Essbase. (CVE-2024-7264)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (Apache Xerces-C++)). (CVE-2024-23807)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (OpenSSL)). (CVE-2024-2511)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the xerces package has been released.

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2476 advisory.

    Apache issued this CVE to indicate the correct versions of xerces-c, which included the fix for     CVE-2018-1311. See the older CVE page for fix status. (CVE-2024-23807)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209277	Oracle Essbase Multiple Vulnerabilities (October 2024 CPU)	Nessus	Misc.	high
205267	Photon OS 3.0: Xerces PHSA-2024-3.0-0778	Nessus	PhotonOS Local Security Checks	high
191519	Amazon Linux 2 : xerces-c (ALAS-2024-2476)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2024-23807

high

Tenable Plugins

Coming Soon

high

high

high