| Unaddressed Advisories |

| The following security advisories apply to current versions of Xerces-C and have not been fixed, in most cases due to insufficient expertise or resources:

- CVE-2018-1311: Apache Xerces-C use-after-free vulnerability scanning external DTD

| Addressed in 3.2.1 and Later Releases |

| The following security advisories apply to versions of Xerces-C older than V3.2.1:

- CVE-2017-12627: Apache Xerces-C DTD vulnerability processing external paths

| Addressed in 3.1.4 and Later Releases |

| The following security advisories apply to versions of Xerces-C older than V3.1.4:

- CVE-2016-4463: Apache Xerces-C XML Parser Crashes on Malformed DTD

| Addressed in 3.1.3 and Later Releases |

| The following security advisories apply to versions of Xerces-C older than V3.1.3:

- CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input

| Addressed in 3.1.2 and Later Releases |

| The following security advisories apply to versions of Xerces-C older than V3.1.2:

- CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input

Copyright © 1999-2017 The Apache Software Foundation. All Rights Reserved.