CVE-2023-37536

NameCVE-2023-37536
DescriptionAn integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3704-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xerces-c (PTS)buster3.2.2+debian-1+deb10u1vulnerable
buster (security)3.2.2+debian-1+deb10u2fixed
bullseye3.2.3+debian-3+deb11u1fixed
bookworm3.2.4+debian-1fixed
trixie3.2.4+debian-1.1fixed
sid3.2.4+debian-1.3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xerces-csourcebuster3.2.2+debian-1+deb10u2DLA-3704-1
xerces-csourcebullseye3.2.3+debian-3+deb11u1
xerces-csource(unstable)3.2.4+debian-1

Notes

https://github.com/apache/xerces-c/pull/51
https://issues.apache.org/jira/browse/XERCESC-2241
Fixed by: https://github.com/apache/xerces-c/commit/1296a40db07308dbaac32494469f609b00cdfaf3 (v3.2.4)

Search for package or bug name: Reporting problems