CVE-2014-0107
- State
- Published
- Severity
- Not scored
- Published
- Apr 15, 2014
- Updated
- Aug 6, 2024
- Reserved
- Dec 3, 2013
Description
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- GLSA-201604-02vendor-advisory
- 59291third-party-advisory
- 59290third-party-advisory
- RHSA-2015:1888vendor-advisory
- 59151third-party-advisory
- 59247third-party-advisory
- 59515third-party-advisory
- DSA-2886vendor-advisory
- 60502third-party-advisory
- 59369third-party-advisory
- 59711third-party-advisory
- 57563third-party-advisory
- 66397vdb-entry
- 1034711vdb-entry
- 1034716vdb-entry
- RHSA-2014:1351vendor-advisory
- RHSA-2014:0348vendor-advisory
- 59036third-party-advisory
- apache-xalanjava-cve20140107-sec-bypass(92023)vdb-entry
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilitiesmailing-list
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilitiesmailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://issues.apache.org/jira/browse/XALANJ-2435
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
- http://www-01.ibm.com/support/docview.wss?uid=swg21676093
- http://www.ibm.com/support/docview.wss?uid=swg21677967
- https://www.tenable.com/security/tns-2018-15
- http://www-01.ibm.com/support/docview.wss?uid=swg21677145
- http://www-01.ibm.com/support/docview.wss?uid=swg21681933
- http://www-01.ibm.com/support/docview.wss?uid=swg21674334
- http://www.ocert.org/advisories/ocert-2014-002.html
- http://svn.apache.org/viewvc?view=revision&revision=1581058
- http://www-01.ibm.com/support/docview.wss?uid=swg21680703
- [tomcat-dev] 20210823 [Bug 65516] New: upgrade to xalan 2.7.2 to address CVE-2014-0107mailing-list
- [tomcat-dev] 20210823 [Bug 65516] upgrade to xalan 2.7.2 to address CVE-2014-0107mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.