VulnerableCode Package Details - pkg:deb/debian/libxalan2-java@2.7.1-5

Search for packages

Vulnerability	Summary	Fixed by
VCID-kcrm-j8h2-8qbt Aliases: CVE-2014-0107 GHSA-rc2w-r4jq-7pfx	The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.	2.7.1-7+deb7u1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 2.7.1-9 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-kcrm-j8h2-8qbt
Aliases:
CVE-2014-0107
GHSA-rc2w-r4jq-7pfx

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

2.7.1-7+deb7u1
Affected by 1 other vulnerability.

2.7.1-9
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-15T19:21:36.796804+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	38.4.0
2026-04-15T12:52:54.084464+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2	38.4.0
2026-04-11T19:04:51.419295+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	38.3.0
2026-04-11T12:41:27.196961+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2	38.3.0
2026-04-08T18:49:12.271737+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2	38.1.0
2026-04-03T21:51:17.410580+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2	38.1.0
2026-04-02T12:57:32.839064+00:00	Debian Oval Importer	Affected by	VCID-kcrm-j8h2-8qbt	https://www.debian.org/security/oval/oval-definitions-wheezy.xml.bz2	38.0.0