{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-24T00:00:00", "descriptions": [{"lang": "en", "value": "The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-10-20T10:37:44", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "GLSA-201604-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201604-02"}, {"name": "59291", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59291"}, {"name": "59290", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59290"}, {"name": "RHSA-2015:1888", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1888.html"}, {"name": "59151", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59151"}, {"name": "59247", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59247"}, {"name": "59515", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59515"}, {"name": "DSA-2886", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-2886"}, {"name": "60502", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/60502"}, {"name": "59369", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59369"}, {"name": "59711", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59711"}, {"name": "57563", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/57563"}, {"name": "66397", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/66397"}, {"name": "1034711", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1034711"}, {"name": "1034716", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1034716"}, {"name": "RHSA-2014:1351", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"}, {"name": "RHSA-2014:0348", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0348.html"}, {"name": "59036", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/59036"}, {"name": "apache-xalanjava-cve20140107-sec-bypass(92023)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92023"}, {"name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"}, {"name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://issues.apache.org/jira/browse/XALANJ-2435"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676093"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21677967"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tenable.com/security/tns-2018-15"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677145"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681933"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21674334"}, {"tags": ["x_refsource_MISC"], "url": "http://www.ocert.org/advisories/ocert-2014-002.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1581058"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680703"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] New: upgrade to xalan 2.7.2 to address CVE-2014-0107", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] upgrade to xalan 2.7.2 to address CVE-2014-0107", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca%40%3Cdev.tomcat.apache.org%3E"}, {"tags": ["x_refsource_MISC"], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-0107", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "GLSA-201604-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201604-02"}, {"name": "59291", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59291"}, {"name": "59290", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59290"}, {"name": "RHSA-2015:1888", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1888.html"}, {"name": "59151", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59151"}, {"name": "59247", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59247"}, {"name": "59515", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59515"}, {"name": "DSA-2886", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-2886"}, {"name": "60502", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/60502"}, {"name": "59369", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59369"}, {"name": "59711", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59711"}, {"name": "57563", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/57563"}, {"name": "66397", "refsource": "BID", "url": "http://www.securityfocus.com/bid/66397"}, {"name": "1034711", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1034711"}, {"name": "1034716", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1034716"}, {"name": "RHSA-2014:1351", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"}, {"name": "RHSA-2014:0348", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-0348.html"}, {"name": "59036", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/59036"}, {"name": "apache-xalanjava-cve20140107-sec-bypass(92023)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92023"}, {"name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E"}, {"name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E"}, {"name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"}, {"name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"name": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"}, {"name": "https://www.oracle.com//security-alerts/cpujul2021.html", "refsource": "MISC", "url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"name": "https://issues.apache.org/jira/browse/XALANJ-2435", "refsource": "CONFIRM", "url": "https://issues.apache.org/jira/browse/XALANJ-2435"}, {"name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755", "refsource": "CONFIRM", "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676093", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676093"}, {"name": "http://www.ibm.com/support/docview.wss?uid=swg21677967", "refsource": "CONFIRM", "url": "http://www.ibm.com/support/docview.wss?uid=swg21677967"}, {"name": "https://www.tenable.com/security/tns-2018-15", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2018-15"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21677145", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677145"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681933", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681933"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21674334", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21674334"}, {"name": "http://www.ocert.org/advisories/ocert-2014-002.html", "refsource": "MISC", "url": "http://www.ocert.org/advisories/ocert-2014-002.html"}, {"name": "http://svn.apache.org/viewvc?view=revision&revision=1581058", "refsource": "CONFIRM", "url": "http://svn.apache.org/viewvc?view=revision&revision=1581058"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21680703", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680703"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] New: upgrade to xalan 2.7.2 to address CVE-2014-0107", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b@%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] upgrade to xalan 2.7.2 to address CVE-2014-0107", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca@%3Cdev.tomcat.apache.org%3E"}, {"name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:05:38.816Z"}, "title": "CVE Program Container", "references": [{"name": "GLSA-201604-02", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201604-02"}, {"name": "59291", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59291"}, {"name": "59290", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59290"}, {"name": "RHSA-2015:1888", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1888.html"}, {"name": "59151", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59151"}, {"name": "59247", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59247"}, {"name": "59515", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59515"}, {"name": "DSA-2886", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2014/dsa-2886"}, {"name": "60502", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/60502"}, {"name": "59369", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59369"}, {"name": "59711", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59711"}, {"name": "57563", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/57563"}, {"name": "66397", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/66397"}, {"name": "1034711", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1034711"}, {"name": "1034716", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1034716"}, {"name": "RHSA-2014:1351", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"}, {"name": "RHSA-2014:0348", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-0348.html"}, {"name": "59036", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/59036"}, {"name": "apache-xalanjava-cve20140107-sec-bypass(92023)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92023"}, {"name": "[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"}, {"name": "[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://issues.apache.org/jira/browse/XALANJ-2435"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676093"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21677967"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tenable.com/security/tns-2018-15"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677145"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681933"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21674334"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.ocert.org/advisories/ocert-2014-002.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1581058"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680703"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] New: upgrade to xalan 2.7.2 to address CVE-2014-0107", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b%40%3Cdev.tomcat.apache.org%3E"}, {"name": "[tomcat-dev] 20210823 [Bug 65516] upgrade to xalan 2.7.2 to address CVE-2014-0107", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca%40%3Cdev.tomcat.apache.org%3E"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-0107", "datePublished": "2014-04-15T17:00:00", "dateReserved": "2013-12-03T00:00:00", "dateUpdated": "2024-08-06T09:05:38.816Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DAC17F1-EBD3-4351-B417-587A2D7501BE", "versionEndIncluding": "2.7.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "F0C500B0-BBEB-4981-B639-48AE9D29FB60", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "5CADED80-EBD1-46A1-AD7D-87BFA26A3C7C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "745CB7DD-92B7-4B50-BE38-44F0BEE12C64", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "CEE19D33-C03D-4443-A460-63AFD5921329", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0A443E45-D5F5-40AC-B937-A02A83732089", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "A6ECB30C-3B99-4532-8A9A-BBA694E91CB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "4BE168C8-3986-4A97-9CDC-ADDEFB21141C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "7675485D-F8E9-4FE5-BD3A-7D26CF65A959", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "F5B1727C-243B-44C2-9AC9-6DEC7719D7FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "4079C93E-4BED-42D0-B196-E8C123B6DB3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "4C3BA792-1902-4AEB-96C1-B2CE26FCB18F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:xalan-java:2.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "5611DEED-93E1-4B28-A8B2-EB46630E9BE6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:webcenter_sites:7.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "F3EEBF10-2C32-4F5E-8245-9C485A191113", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "1BB4709C-6373-43CC-918C-876A6569865A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function."}, {"lang": "es", "value": "El TransformerFactory en Apache Xalan-Java anterior a 2.7.2 no restringe debidamente el acceso a ciertas propiedades cuando FEATURE_SECURE_PROCESSING est\u00e1 habilitado, lo cual permite a atacantes remotos evadir restricciones y cargar clases arbitrarias o acceder a recursos externos a trav\u00e9s de una propiedad (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header o (4) xslt:entities manipulada, o una propiedad Java que est\u00e1 ligada a la funci\u00f3n XSLT 1.0 system-property."}], "id": "CVE-2014-0107", "lastModified": "2023-11-07T02:18:08.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-15T23:13:13.070", "references": [{"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2014-0348.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2014-1351.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1888.html"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/57563"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59036"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59151"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59247"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59290"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59291"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59369"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59515"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/59711"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/60502"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://svn.apache.org/viewvc?view=revision&revision=1581058"}, {"source": "secalert@redhat.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21674334"}, {"source": "secalert@redhat.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676093"}, {"source": "secalert@redhat.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21677145"}, {"source": "secalert@redhat.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21680703"}, {"source": "secalert@redhat.com", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681933"}, {"source": "secalert@redhat.com", "url": "http://www.debian.org/security/2014/dsa-2886"}, {"source": "secalert@redhat.com", "url": "http://www.ibm.com/support/docview.wss?uid=swg21677967"}, {"source": "secalert@redhat.com", "tags": ["US Government Resource"], "url": "http://www.ocert.org/advisories/ocert-2014-002.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/66397"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id/1034711"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id/1034716"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/92023"}, {"source": "secalert@redhat.com", "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755"}, {"source": "secalert@redhat.com", "url": "https://issues.apache.org/jira/browse/XALANJ-2435"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b%40%3Cdev.tomcat.apache.org%3E"}, {"source": "secalert@redhat.com", "url": "https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca%40%3Cdev.tomcat.apache.org%3E"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/201604-02"}, {"source": "secalert@redhat.com", "url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"source": "secalert@redhat.com", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}, {"source": "secalert@redhat.com", "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"}, {"source": "secalert@redhat.com", "url": "https://www.tenable.com/security/tns-2018-15"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1369", "cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0", "product_name": "Fuse ESB Enterprise 7.1.0", "release_date": "2014-10-09T00:00:00Z"}, {"advisory": "RHSA-2014:1369", "cpe": "cpe:/a:redhat:fuse_management_console:7.1.0", "product_name": "Fuse Management Console 7.1.0", "release_date": "2014-10-09T00:00:00Z"}, {"advisory": "RHSA-2014:1369", "cpe": "cpe:/a:redhat:fuse_mq_enterprise:7.1.0", "product_name": "Fuse MQ Enterprise 7.1.0", "release_date": "2014-10-09T00:00:00Z"}, {"advisory": "RHSA-2014:1007", "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:5.3", "package": "xalan-j2", "product_name": "JBoss Enterprise BRMS Platform 5.3", "release_date": "2014-08-05T00:00:00Z"}, {"advisory": "RHSA-2014:0348", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "xalan-j2-0:2.7.0-6jpp.2", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2014-04-01T00:00:00Z"}, {"advisory": "RHSA-2014:0348", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "xalan-j2-0:2.7.0-9.9.el6_5", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2014-04-01T00:00:00Z"}, {"advisory": "RHSA-2014:1351", "cpe": "cpe:/a:redhat:jboss_amq:6.1.0", "product_name": "Red Hat JBoss A-MQ 6.1", "release_date": "2014-10-01T00:00:00Z"}, {"advisory": "RHSA-2014:0819", "cpe": "cpe:/a:redhat:jboss_bpms:6.0", "package": "xalan-j2", "product_name": "Red Hat JBoss BPMS 6.0", "release_date": "2014-06-30T00:00:00Z"}, {"advisory": "RHSA-2014:1291", "cpe": "cpe:/a:redhat:jboss_bpms:6.0", "package": "xalan-j2", "product_name": "Red Hat JBoss BPMS 6.0", "release_date": "2014-09-23T00:00:00Z"}, {"advisory": "RHSA-2014:0818", "cpe": "cpe:/a:redhat:jboss_brms:6.0", "package": "xalan-j2", "product_name": "Red Hat JBoss BRMS 6.0", "release_date": "2014-06-30T00:00:00Z"}, {"advisory": "RHSA-2014:1290", "cpe": "cpe:/a:redhat:jboss_brms:6.0", "package": "xalan-j2", "product_name": "Red Hat JBoss BRMS 6.0", "release_date": "2014-09-23T00:00:00Z"}, {"advisory": "RHSA-2014:0590", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5.2.0", "package": "xalan-j2", "product_name": "Red Hat JBoss Enterprise Application Platform 5.2", "release_date": "2014-06-02T00:00:00Z"}, {"advisory": "RHSA-2014:0591", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el4", "package": "xalan-j2-0:2.7.1-12_patch_08.ep5.el4", "product_name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 4", "release_date": "2014-06-02T00:00:00Z"}, {"advisory": "RHSA-2014:0591", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el5", "package": "xalan-j2-0:2.7.1-12_patch_08.ep5.el5", "product_name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 5", "release_date": "2014-06-02T00:00:00Z"}, {"advisory": "RHSA-2014:0591", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5::el6", "package": "xalan-j2-0:2.7.1-12_patch_08.ep5.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 5 for RHEL 6", "release_date": "2014-06-02T00:00:00Z"}, {"advisory": "RHSA-2014:0454", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.2", "package": "xalan-j2", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:0453", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el5", "package": "xalan-j2-eap6-0:2.7.1-9.redhat_7.1.ep6.el5", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:0453", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6::el6", "package": "xalan-j2-eap6-0:2.7.1-9.redhat_7.1.ep6.el6", "product_name": "Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6", "release_date": "2014-04-30T00:00:00Z"}, {"advisory": "RHSA-2014:1351", "cpe": "cpe:/a:redhat:jboss_fuse:6.1.0", "product_name": "Red Hat JBoss Fuse 6.1", "release_date": "2014-10-01T00:00:00Z"}, {"advisory": "RHSA-2014:1995", "cpe": "cpe:/a:redhat:jboss_fuse_service_works:6.0", "package": "xalan-j2", "product_name": "Red Hat JBoss Fuse Service Works 6.0", "release_date": "2014-12-15T00:00:00Z"}, {"advisory": "RHSA-2014:1059", "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:5.2.2", "package": "xalan-j2", "product_name": "Red Hat JBoss Portal 5.2", "release_date": "2014-08-14T00:00:00Z"}, {"advisory": "RHSA-2015:1009", "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.2", "package": "xalan-j2", "product_name": "Red Hat JBoss Portal 6.2", "release_date": "2015-05-14T00:00:00Z"}, {"advisory": "RHSA-2015:1888", "cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3", "package": "xalan-j2", "product_name": "Red Hat JBoss SOA Platform 5.3", "release_date": "2015-10-12T00:00:00Z"}], "bugzilla": {"description": "Xalan-Java: insufficient constraints in secure processing feature", "id": "1080248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080248"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "verified"}, "cwe": "CWE-358", "details": ["The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.", "It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java."], "name": "CVE-2014-0107", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "xalan-j2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:7::hypervisor", "fix_state": "Not affected", "package_name": "jasperreports-server-pro", "product_name": "Red Hat Enterprise Virtualization 3"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:6", "fix_state": "Not affected", "package_name": "xalan-j2", "product_name": "Red Hat JBoss Data Grid 6"}, {"cpe": "cpe:/a:redhat:jboss_data_virtualization:6", "fix_state": "Not affected", "package_name": "xalan-j2", "product_name": "Red Hat JBoss Data Virtualization 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:4", "fix_state": "Will not fix", "package_name": "xalan-j2", "product_name": "Red Hat JBoss Enterprise Application Platform 4"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "amq-6.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-6.0", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-esb-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "fuse-mq-7.1", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Affected", "package_name": "xalan-j2", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_operations_network:3", "fix_state": "Not affected", "package_name": "xalan-j2", "product_name": "Red Hat JBoss Operations Network 3"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:4.3", "fix_state": "Will not fix", "package_name": "xalan-j2", "product_name": "Red Hat JBoss SOA Platform 4.3"}, {"cpe": "cpe:/a:redhat:network_satellite:5.4", "fix_state": "Will not fix", "package_name": "xalan-j2", "product_name": "Red Hat Satellite 5.4"}, {"cpe": "cpe:/a:redhat:network_satellite:5.5", "fix_state": "Will not fix", "package_name": "xalan-j2", "product_name": "Red Hat Satellite 5.5"}], "public_date": "2014-03-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-0107\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-0107\nhttp://www.ocert.org/advisories/ocert-2014-002.html"], "threat_severity": "Important", "upstream_fix": "xalan-j2 2.7.2"}