Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/libxerces2-java@2.12.1-1?distro=trixie
purl pkg:deb/debian/libxerces2-java@2.12.1-1?distro=trixie
Next non-vulnerable version 2.12.2-1
Latest non-vulnerable version 2.12.2-1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-c2s2-wsy6-sufn
Aliases:
CVE-2022-23437
GHSA-h65f-jvqw-m9fj
XML Injection (aka Blind XPath Injection) There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
2.12.2-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-2gpd-vwgb-67cn XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. CVE-2009-2625
GHSA-334p-wv2m-w3vp

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T11:16:44.744595+00:00 Debian Importer Fixing VCID-2gpd-vwgb-67cn https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-13T07:40:21.239613+00:00 Debian Importer Fixing VCID-2gpd-vwgb-67cn https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-03T07:30:01.035268+00:00 Debian Importer Affected by VCID-c2s2-wsy6-sufn https://security-tracker.debian.org/tracker/data/json 38.1.0
2026-04-03T07:30:01.009146+00:00 Debian Importer Fixing VCID-2gpd-vwgb-67cn https://security-tracker.debian.org/tracker/data/json 38.1.0