[XERCESC-2188] Use-after-free on external DTD scan

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.2.0, 3.1.3, 3.1.4, 3.2.1, 3.2.2
• Fix Version/s: 3.2.5
• Component/s: Validating Parser (DTD)
• Assignee: Boris Kolpackov
• Reporter: Scott Cantor
• Created: 16/Dec/19 23:19
• Updated: 20/Dec/23 13:51
• Resolved: 20/Dec/23 13:51

Description

This is a record of an unfixed bug reported in 2018 in the DTD scanner, per the attached PDF, corresponding to CVE-2018-1311.

Issue Links

• links to: GitHub Pull Request #47
• links to: GitHub Pull Request #54