CVE-2014-3004
Fixed upstream EPSS 9%
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
Products: castor_project castor, opensuse, opensuse_project opensuse
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | castor:castor | no fix |
| Maven | org.codehaus.castor:castor | 1.3.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 16.04 LTS | castor | no fix |
| Ubuntu 18.04 LTS | castor | no fix |
| Ubuntu 20.04 LTS | castor | no fix |
| Ubuntu 22.04 LTS | castor | no fix |
| Ubuntu 24.04 LTS | castor | no fix |
| Ubuntu 25.10 | castor | no fix |
| Ubuntu 26.04 LTS | castor | no fix |
| Ubuntu 26.10 | castor | no fix |