CVE-2014-0107
Fixed in a distro release EPSS 14%
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
Products: apache xalan-java, oracle webcenter_sites
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | xalan:xalan | 2.7.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libxalan2-java | 2.7.1-9 |
| Debian 13 | libxalan2-java | 2.7.1-9 |
| Debian 14 | libxalan2-java | 2.7.1-9 |
| Debian 6.0 | libxalan2-java | 2.7.1-5+deb6u1 |
| Debian 7 | libxalan2-java | 2.7.1-7+deb7u1 |
| Red Hat Enterprise Linux 5 | xalan-j2 | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 5 | xalan-j2-debuginfo | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 5 | xalan-j2-demo | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 5 | xalan-j2-javadoc | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 5 | xalan-j2-manual | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 5 | xalan-j2-xsltc | 0:2.7.0-6jpp.2 |
| Red Hat Enterprise Linux 6 | xalan-j2 | 0:2.7.0-9.9.el6_5 |
| Red Hat Enterprise Linux 6 | xalan-j2-demo | 0:2.7.0-9.9.el6_5 |
| Red Hat Enterprise Linux 6 | xalan-j2-javadoc | 0:2.7.0-9.9.el6_5 |
| Red Hat Enterprise Linux 6 | xalan-j2-manual | 0:2.7.0-9.9.el6_5 |
| Red Hat Enterprise Linux 6 | xalan-j2-xsltc | 0:2.7.0-9.9.el6_5 |
| Red Hat jboss enterprise application platform 5 | xalan-j2 | 0:2.7.1-12_patch_08.ep5.el4 |
| Red Hat jboss enterprise application platform 5 | xalan-j2 | 0:2.7.1-12_patch_08.ep5.el5 |
| Red Hat jboss enterprise application platform 5 | xalan-j2 | 0:2.7.1-12_patch_08.ep5.el6 |
| Red Hat jboss enterprise application platform 6 | xalan-j2-eap6 | 0:2.7.1-9.redhat_7.1.ep6.el5 |
| Red Hat jboss enterprise application platform 6 | xalan-j2-eap6 | 0:2.7.1-9.redhat_7.1.ep6.el6 |
| openSUSE Tumbleweed | xalan-j2 | 2.7.2-5.4 |