Cloudanix VulnDB

CVE-2014-0107

None

CVSS

—

EPSS

14.1%

Published

Apr 15, 2014

CISA due date

—

The record

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

Affected packages

Ecosystem Package Introduced Fixed
Maven xalan:xalan 0 2.7.2
Debian:11 libxalan2-java 0 2.7.1-9
Debian:12 libxalan2-java 0 2.7.1-9
Debian:13 libxalan2-java 0 2.7.1-9
Debian:6.0 libxalan2-java 0 2.7.1-5+deb6u1
Debian:7 libxalan2-java 0 2.7.1-7+deb7u1
Mageia:3 xalan-j2 0 2.7.1-5.1.mga3
Mageia:4 xalan-j2 0 2.7.1-6.1.mga4
Red Hat:enterprise_linux:5::client xalan-j2 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client xalan-j2-debuginfo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client xalan-j2-demo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client xalan-j2-javadoc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client xalan-j2-manual 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client xalan-j2-xsltc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2-debuginfo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2-demo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2-javadoc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2-manual 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::client_workstation xalan-j2-xsltc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2-debuginfo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2-demo 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2-javadoc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2-manual 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:5::server xalan-j2-xsltc 0 0:2.7.0-6jpp.2
Red Hat:enterprise_linux:6::client xalan-j2 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::client xalan-j2-demo 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::client xalan-j2-javadoc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::client xalan-j2-manual 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::client xalan-j2-xsltc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::computenode xalan-j2 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::computenode xalan-j2-demo 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::computenode xalan-j2-javadoc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::computenode xalan-j2-manual 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::computenode xalan-j2-xsltc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::server xalan-j2 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::server xalan-j2-demo 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::server xalan-j2-javadoc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::server xalan-j2-manual 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::server xalan-j2-xsltc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::workstation xalan-j2 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::workstation xalan-j2-demo 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::workstation xalan-j2-javadoc 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::workstation xalan-j2-manual 0 0:2.7.0-9.9.el6_5
Red Hat:enterprise_linux:6::workstation xalan-j2-xsltc 0 0:2.7.0-9.9.el6_5
Red Hat:jboss_enterprise_application_platform:5::el4 xalan-j2 0 0:2.7.1-12_patch_08.ep5.el4
Red Hat:jboss_enterprise_application_platform:5::el5 xalan-j2 0 0:2.7.1-12_patch_08.ep5.el5
Red Hat:jboss_enterprise_application_platform:5::el6 xalan-j2 0 0:2.7.1-12_patch_08.ep5.el6
Red Hat:jboss_enterprise_application_platform:6::el5 xalan-j2-eap6 0 0:2.7.1-9.redhat_7.1.ep6.el5
Red Hat:jboss_enterprise_application_platform:6::el6 xalan-j2-eap6 0 0:2.7.1-9.redhat_7.1.ep6.el6
Ubuntu:14.04:LTS libxalan2-java 0 2.7.1-9
openSUSE:Tumbleweed xalan-j2 0 2.7.2-5.4

Related vulnerabilities