CVE-2008-4482
published 2008-10-08CVE-2008-4482: The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema…
PriorityP428high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
4.18%
89.8th percentile
The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | xerces-c | <= 2.8.0 | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
| apache | xerces-c | — | — |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2008-4482: The XML parser in Xerces-C++ before 3
vendor_redhat·CVSS 7.8
CVE-2008-4482 [HIGH] CVE-2008-4482: The XML parser in Xerces-C++ before 3
The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
Statement: Not Vulnerable. Red Hat Enterprise MRG does not use Xerces-C++ in a manner that is vulnerable to this flaw.
GHSA
GHSA-37q4-89pv-rvxq: The XML parser in Xerces-C++ before 3
ghsa_unreviewed·2022-05-02
CVE-2008-4482 [HIGH] CWE-20 GHSA-37q4-89pv-rvxq: The XML parser in Xerces-C++ before 3
The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://issues.apache.org/jira/browse/XERCESC-1051http://secunia.com/advisories/32108http://www.securityfocus.com/bid/31533http://xerces.apache.org/xerces-c/releases.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/45596http://issues.apache.org/jira/browse/XERCESC-1051http://secunia.com/advisories/32108http://www.securityfocus.com/bid/31533http://xerces.apache.org/xerces-c/releases.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/45596
2008-10-08
Published