CVE-2013-4002 Missing XML Validation in Apache Xerces2
HighCVSS 7.1
EPSS 24.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xerces/xercesImpl(Maven) | < 2.12.0 | 2.12.0 |
| xerces/xercesImpl(Maven) | = 2.0.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.0.2 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.10.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.11.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.2.1 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.3.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.4.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.5.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.6.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.6.1 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.6.2 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.6.2-jaxb-1.0.6 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.7.1 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.8.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.8.1 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.9.0 | No fix listed |
| xerces/xercesImpl(Maven) | = 2.9.1 | No fix listed |
| ibm java | = 5.0.0.0 | No fix listed |
| ibm java | = 5.0.11.0 | No fix listed |
| ibm java | = 5.0.11.1 | No fix listed |
| ibm java | = 5.0.11.2 | No fix listed |
| ibm java | = 5.0.12.0 | No fix listed |
| ibm java | = 5.0.12.1 | No fix listed |
| ibm java | = 5.0.12.2 | No fix listed |
Show 81 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm java | = 5.0.12.3 | No fix listed |
| ibm java | = 5.0.12.4 | No fix listed |
| ibm java | = 5.0.12.5 | No fix listed |
| ibm java | = 5.0.13.0 | No fix listed |
| ibm java | = 5.0.14.0 | No fix listed |
| ibm java | = 5.0.15.0 | No fix listed |
| ibm java | = 5.0.16.0 | No fix listed |
| ibm java | = 5.0.16.1 | No fix listed |
| ibm java | = 5.0.16.2 | No fix listed |
| ibm java | = 6.0.0.0 | No fix listed |
| ibm java | = 6.0.1.0 | No fix listed |
| ibm java | = 6.0.2.0 | No fix listed |
| ibm java | = 6.0.3.0 | No fix listed |
| ibm java | = 6.0.4.0 | No fix listed |
| ibm java | = 6.0.5.0 | No fix listed |
| ibm java | = 6.0.6.0 | No fix listed |
| ibm java | = 6.0.7.0 | No fix listed |
| ibm java | = 6.0.8.0 | No fix listed |
| ibm java | = 6.0.8.1 | No fix listed |
| ibm java | = 6.0.9.0 | No fix listed |
| ibm java | = 6.0.9.1 | No fix listed |
| ibm java | = 6.0.9.2 | No fix listed |
| ibm java | = 6.0.10.0 | No fix listed |
| ibm java | = 6.0.10.1 | No fix listed |
| ibm java | = 6.0.11.0 | No fix listed |
| ibm java | = 6.0.12.0 | No fix listed |
| ibm java | = 6.0.13.0 | No fix listed |
| ibm java | = 6.0.13.1 | No fix listed |
| ibm java | = 6.0.13.2 | No fix listed |
| ibm java | = 7.0.0.0 | No fix listed |
| ibm java | = 7.0.1.0 | No fix listed |
| ibm java | = 7.0.2.0 | No fix listed |
| ibm java | = 7.0.3.0 | No fix listed |
| ibm java | = 7.0.4.0 | No fix listed |
| ibm java | = 7.0.4.1 | No fix listed |
| ibm java | = 7.0.4.2 | No fix listed |
| oracle jdk | = 1.5.0-update51 | No fix listed |
| oracle jdk | = 1.6.0-update60 | No fix listed |
| oracle jdk | = 1.7.0-update40 | No fix listed |
| oracle jre | = 1.5.0-update51 | No fix listed |
| oracle jre | = 1.6.0-update60 | No fix listed |
| oracle jre | = 1.7.0-update40 | No fix listed |
| oracle jrockit | >= r27.7.0, <= r27.7.6 | No fix listed |
| oracle jrockit | >= r28.0.0, <= r28.2.8 | No fix listed |
| ibm sterling b2b integrator | = 5.2.4 | No fix listed |
| ibm sterling b2b integrator | = 5.1 | No fix listed |
| ibm sterling b2b integrator | = 5.2 | No fix listed |
| ibm host on-demand | = 11.0 | No fix listed |
| ibm host on-demand | = 11.0.1 | No fix listed |
| ibm host on-demand | = 11.0.2 | No fix listed |
| ibm host on-demand | = 11.0.3 | No fix listed |
| ibm host on-demand | = 11.0.4 | No fix listed |
| ibm host on-demand | = 11.0.5 | No fix listed |
| ibm host on-demand | = 11.0.5.1 | No fix listed |
| ibm host on-demand | = 11.0.6 | No fix listed |
| ibm host on-demand | = 11.0.6.1 | No fix listed |
| ibm host on-demand | = 11.0.7 | No fix listed |
| ibm host on-demand | = 11.0.8 | No fix listed |
| ibm tivoli application dependency discovery manager | = 7.2.2 | No fix listed |
| ibm sterling file gateway | = 2.1 | No fix listed |
| ibm sterling file gateway | = 2.2 | No fix listed |
| opensuse | = 12.2 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| SUSE linux enterprise desktop | = 10-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise java | = 10-sp4 | No fix listed |
| SUSE linux enterprise java | = 11-sp2 | No fix listed |
| SUSE linux enterprise java | = 11-sp3 | No fix listed |
| SUSE linux enterprise sdk | = 11-sp2 | No fix listed |
| SUSE linux enterprise sdk | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 9 | No fix listed |
| SUSE linux enterprise server | = 10-sp3 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
| apache xerces2 java | >= 2.4.0, < 2.12.0 | 2.12.0 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- RHSA-2014:0414 third-party-advisory vendor-advisory
- ibm-java-cve20134002-dos(85260) vdb-entry vendor-advisory
- github.com product
- issues.apache.org issue-tracking vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- www.oracle.com
- www.oracle.com third-party-advisory
- APPLE-SA-2013-10-15-1 broken-link mailing-list vendor-advisory
- SUSE-SU-2013:1255 third-party-advisory vendor-advisory
- SUSE-SU-2013:1256 third-party-advisory vendor-advisory
- SUSE-SU-2013:1257 third-party-advisory vendor-advisory
- SUSE-SU-2013:1263 third-party-advisory vendor-advisory
- SUSE-SU-2013:1293 third-party-advisory vendor-advisory
- SUSE-SU-2013:1305 third-party-advisory vendor-advisory
- SUSE-SU-2013:1666 third-party-advisory vendor-advisory
- openSUSE-SU-2013:1663 third-party-advisory vendor-advisory
- HPSBUX02943 issue-tracking mailing-list third-party-advisory vendor-advisory
- HPSBUX02944 issue-tracking mailing-list third-party-advisory vendor-advisory
- RHSA-2013:1059 broken-link vendor-advisory
- RHSA-2013:1060 broken-link vendor-advisory
- RHSA-2013:1081 broken-link vendor-advisory
- RHSA-2013:1440 broken-link vendor-advisory
- RHSA-2013:1447 broken-link vendor-advisory
- RHSA-2013:1451 broken-link vendor-advisory
- RHSA-2013:1505 broken-link vendor-advisory
- RHSA-2014:1818 broken-link vendor-advisory
- RHSA-2014:1821 broken-link vendor-advisory
- RHSA-2014:1822 broken-link vendor-advisory
- RHSA-2014:1823 broken-link vendor-advisory
- RHSA-2015:0675 broken-link vendor-advisory
- RHSA-2015:0720 broken-link vendor-advisory
- RHSA-2015:0765 broken-link vendor-advisory
- RHSA-2015:0773 broken-link vendor-advisory
- GLSA-201406-32 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- svn.apache.org patch vendor-advisory
- IC98015 vendor-advisory
- www-01.ibm.com vendor-advisory
- www-01.ibm.com vendor-advisory
- www-01.ibm.com vendor-advisory
- www.hitachi.co.jp third-party-advisory
- www.ibm.com vendor-advisory
- www.ibm.com vendor-advisory
- www.ibm.com broken-link
- USN-2033-1 third-party-advisory vendor-advisory
- USN-2089-1 third-party-advisory vendor-advisory
- github.com
- 56257 third-party-advisory
- 61310 third-party-advisory vdb-entry
- [j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available mailing-list
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list