CVE-2018-1311

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

9.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 94.9% of scored records. A rank, not a probability.

NVD base score

8.1 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2019-12-18 00:00Z6 YR AGO

Last updated

2025-11-04 18:14Z11 MO AGO

Reserved

2017-12-07

Assigning CNA

apache

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

• CWE-416Use After FreeVariant

Data version

5.2

Document digest

e7ba4d646f6ba1517216fe84a5cc1d7558d1c965c8e96fc10192e425a2c34103

• lists.apache.org[xerces-c-dev] 20200110 [xerces-c] 06/13: Add CVE-2018-1311 advisory and web site note.https://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3Emailing-list
• access.redhat.comRHSA-2020:0704https://access.redhat.com/errata/RHSA-2020:0704vendor-advisory
• access.redhat.comRHSA-2020:0702https://access.redhat.com/errata/RHSA-2020:0702vendor-advisory
• lists.debian.org[debian-lts-announce] 20201217 [SECURITY] [DLA 2498-1] xerces-c security updatehttps://lists.debian.org/debian-lts-announce/2020/12/msg00025.htmlmailing-list
• www.debian.orgDSA-4814https://www.debian.org/security/2020/dsa-4814vendor-advisory
• lists.apache.org[xerces-c-users] 20210528 Security vulnerability - CVE-2018-1311https://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3Emailing-list
• lists.apache.org[xerces-c-users] 20210528 RE: Security vulnerability - CVE-2018-1311https://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3Emailing-list
• lists.apache.org[xerces-c-users] 20210528 Re: Security vulnerability - CVE-2018-1311https://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3Emailing-list
• www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
• marc.infohttps://marc.info/?l=xerces-c-users&m=157653840106914&w=2
• lists.fedoraproject.orgFEDORA-2023-52ba628e03https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/vendor-advisory
• lists.fedoraproject.orgFEDORA-2023-817ecc703fhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/vendor-advisory
• lists.debian.org[debian-lts-announce] 20231231 [SECURITY] [DLA 3704-1] xerces-c security updatehttps://lists.debian.org/debian-lts-announce/2023/12/msg00027.htmlmailing-list
• www.openwall.com[oss-security] 20240216 CVE-2024-23807: Apache Xerces C++: Use-after-free on external DTD scanhttp://www.openwall.com/lists/oss-security/2024/02/16/1mailing-list
• lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/