CVE-2023-37536

What it actually does

Integer overflow in Xerces-C++ 3.2.3 parser leads to out-of-bounds memory access when handling crafted input over HTTP.

Why it matters to the business

Attackers could read sensitive data, modify system behavior, or disrupt services in platforms that rely on the affected XML parser, increasing breach and downtime risk in environments that remain unpatched more than three years after disclosure.

How an attack unfolds

An attacker sends a specially crafted HTTP request containing malformed XML that triggers the integer overflow in Xerces-C++ 3.2.3, resulting in out-of-bounds memory access that can be leveraged for information disclosure or code execution.

How to fix it

Upgrade Apache Xerces-C++ beyond version 3.2.3 and apply the latest HCL BigFix Platform patches that address the integer overflow; Fedora users should install updated packages from their distribution repositories.

How to confirm the fix worked

Confirm Xerces-C++ version is newer than 3.2.3 on all affected systems, retest XML parsing endpoints with known overflow test cases, and verify that crafted inputs no longer produce out-of-bounds behavior or crashes.

Typical attack path

1. Identify a reachable HTTP endpoint that processes XML via Xerces-C++ in BigFix Platform or dependent products
2. Craft and transmit an HTTP request containing oversized or malformed XML data designed to overflow an integer
3. Trigger out-of-bounds memory access to read adjacent memory or corrupt control structures
4. Escalate to data exfiltration, unauthorized actions, or remote code execution

How to detect it

Inspect web server and application logs for HTTP requests with unusually large XML bodies or malformed structures targeting XML-parsing endpoints; monitor process crashes or memory corruption indicators in BigFix Platform services.

What your security team should do

• Prioritize patching BigFix Platform and any direct Xerces-C++ dependencies given the high CVSS and network attack vector
• Add XML input validation and size limits at application entry points until patches are deployed
• Review logs for unusual HTTP requests containing large or malformed XML payloads