CVE-2017-12627

In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions.

• CWE-476

• http://seclists.org/oss-sec/2018/q1/203Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/103219Third Party Advisory, VDB Entry
• http://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txtVendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://lists.debian.org/debian-lts-announce/2018/03/msg00032.html
• http://seclists.org/oss-sec/2018/q1/203Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/103219Third Party Advisory, VDB Entry
• http://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txtVendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://lists.debian.org/debian-lts-announce/2018/03/msg00032.html

Published

Mar 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12621During Jelly (xml) file parsing with Apache Xerces, if a cus…9.8
• CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in s…
• CVE-2017-12623An authorized user could upload a template which contained m…
• CVE-2017-12624Apache CXF supports sending and receiving attachments via ei…
• CVE-2017-12625Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.…
• CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable …7.5
• CVE-2017-12628The JMX server embedded in Apache James, also used by the co…
• CVE-2017-12629Remote code execution occurs in Apache Solr before 7.1 with …9.8
• CVE-2017-12630In Apache Drill 1.11.0 and earlier when submitting form from…
• CVE-2017-12631Apache CXF Fediz ships with a number of container-specific p…
• CVE-2017-12632A malicious host header in an incoming HTTP request could ca…
• CVE-2017-12633The camel-hessian component in Apache Camel 2.x before 2.19.…