The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

An update of the xerces package has been released.

The version of xerces-c installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23807 advisory.

  - The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered     during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the     issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a     standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been     disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be     fixed in version 3.2.3 or 3.2.4. (CVE-2024-23807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of xerces-c installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-23807 advisory.

  - The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered     during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the     issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a     standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been     disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be     fixed in version 3.2.3 or 3.2.4. (CVE-2024-23807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (curl)). The supported version that is affected is     21.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols     to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Essbase. (CVE-2024-7264)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (Apache Xerces-C++)). (CVE-2024-23807)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (OpenSSL)). (CVE-2024-2511)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of xerces-c installed on the remote host is prior to 3.1.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2476 advisory.

    Apache issued this CVE to indicate the correct versions of xerces-c, which included the fix for     CVE-2018-1311. See the older CVE page for fix status. (CVE-2024-23807)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216904	Photon OS 4.0: Xerces PHSA-2025-4.0-0761	Nessus	PhotonOS Local Security Checks	critical
216878	Photon OS 5.0: Xerces PHSA-2025-5.0-0480	Nessus	PhotonOS Local Security Checks	critical
216090	Azure Linux 3.0 Security Update: xerces-c (CVE-2024-23807)	Nessus	Azure Linux Local Security Checks	critical
214797	CBL Mariner 2.0 Security Update: xerces-c (CVE-2024-23807)	Nessus	MarinerOS Local Security Checks	critical
209277	Oracle Essbase Multiple Vulnerabilities (October 2024 CPU)	Nessus	Misc.	critical
205267	Photon OS 3.0: Xerces PHSA-2024-3.0-0778	Nessus	PhotonOS Local Security Checks	critical
191519	Amazon Linux 2 : xerces-c (ALAS-2024-2476)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2024-23807

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical