CVE-2024-23807

Name of the Vulnerable Software and Affected Versions Apache Xerces C++ XML parser versions 3.0.0 through 3.2.5

Description The issue is related to a use-after-free error triggered during the scanning of external DTDs. This can allow a remote attacker to execute arbitrary code. Users can mitigate the issue by disabling DTD processing, which can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES DISABLE DTD environment variable.

Recommendations To resolve the issue, upgrade to version 3.2.5, which fixes the problem. As a temporary workaround, consider disabling DTD processing via the DOM using a standard parser feature, or via SAX using the XERCES DISABLE DTD environment variable.