« Volver al listado

CVE-2008-4482

Estado: ModificadaAlta (7.8)—

El analizador XML en Xerces-C++ versiones anteriores a 3.0.0, permite a los atacantes dependientes de contexto causar una denegación de servicios (consumo de pila y caída) a través de un esquema de definición XML con un valor largo maxOccurs, el cual lanza un excesivo consumo de memoria durante la validación de un archivo XML.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Xerces-c++

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4482",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-10-08T02:00:01.267",
  "references": [
    {
      "url": "http://issues.apache.org/jira/browse/XERCESC-1051",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32108",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31533",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://xerces.apache.org/xerces-c/releases.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45596",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://issues.apache.org/jira/browse/XERCESC-1051",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32108",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31533",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://xerces.apache.org/xerces-c/releases.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45596",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file."
    },
    {
      "lang": "es",
      "value": "El analizador XML en Xerces-C++ versiones anteriores a 3.0.0, permite a los atacantes dependientes de contexto causar una denegación de servicios (consumo de pila y caída) a través de un esquema de definición XML con un valor largo maxOccurs, el cual lanza un excesivo consumo de memoria durante la validación de un archivo XML."
    }
  ],
  "lastModified": "2026-06-16T22:57:53.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9217BE2F-D83B-4808-9829-F96694D9744D",
              "versionEndIncluding": "2.8.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "568CFB1C-B7E6-4E9E-A1D2-68649ECCDC08"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "998FBACC-799E-49BA-B5D8-D8EB0A4761C8"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B48C9D91-FC42-4806-8EBA-B47E19EB3B35"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CD2F3C7-3764-4A74-A702-DEA03DDB9CC0"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2553647B-FE08-4C9E-8171-4F768DA529B8"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C7A4853-F0D3-4D24-B739-F632B5DB11B1"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D765E51D-150F-49AC-BDE0-6E59041B0434"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C835FB54-A31B-4C00-A2FD-868769B46FAE"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:1.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5C179CD-415A-41A1-8327-657F9A1CB967"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A68344B-CEB2-4A3F-8C2E-8C0D32B21525"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85DAE439-D943-4ADC-A971-A6CB0519EE49"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CA0B545-6088-49DE-A9D9-074BCC4A7AC8"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82C0855F-7EE8-4F56-ACBB-A64855ED0FE6"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2C7BA37-EAB4-47C7-BB28-2B75BEF632AC"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB6DCE7B-2112-46A3-8E6C-013099FFB722"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2369E73-C4A8-46ED-8A1F-6BC2E3C8D478"
            },
            {
              "criteria": "cpe:2.3:a:apache:xerces-c\\+\\+:2.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00E71C8D-D4DF-4F54-8CF8-D2AA67AC5690"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not Vulnerable. Red Hat Enterprise MRG does not use Xerces-C++ in a manner that is vulnerable to this flaw.",
      "lastModified": "2008-12-02T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}