CVE-2023-37536

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

Score

CVSS 3.1 8.8 High

Status

Modified - psirt@hcl.com

Published

2023-10-11

Last modified

2025-02-13

Weaknesses

CWE-190, CWE-680

Affected products

• Xerces-c++ (Apache)
• Fedora (Fedoraproject)
• Bigfix Platform (Hcl Software)
• Bigfix Platform (Hcltech)

References

• https://lists.debian.org/debian-lts-announce/2023/12/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP…
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVAD…
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAOSSJ72CUJ535VRWTCVQKUY…
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107791