Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-7j4h-8wpf-rqfh
Advisory ID github_osv/GHSA-7j4h-8wpf-rqfh
Aliases CVE-2013-4002
Summary Missing XML Validation in Apache Xerces2 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-112 Missing XML Validation
System Score Found at
generic_textual HIGH
Reference id Reference type URL
http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.html
http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.html
http://marc.info/?l=bugtraq&m=138674031212883&w=2
http://marc.info/?l=bugtraq&m=138674073720143&w=2
http://rhn.redhat.com/errata/RHSA-2013-1440.html
http://rhn.redhat.com/errata/RHSA-2013-1447.html
http://rhn.redhat.com/errata/RHSA-2013-1451.html
http://rhn.redhat.com/errata/RHSA-2013-1505.html
http://rhn.redhat.com/errata/RHSA-2014-1818.html
http://rhn.redhat.com/errata/RHSA-2014-1821.html
http://rhn.redhat.com/errata/RHSA-2014-1822.html
http://rhn.redhat.com/errata/RHSA-2014-1823.html
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0720.html
http://rhn.redhat.com/errata/RHSA-2015-0765.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/85260
https://github.com/apache/xerces2-j
https://github.com/apache/xerces2-j/commit/266e837852e0f0e3c8c1ad572b6fc4dbb4ded17
https://issues.apache.org/jira/browse/XERCESJ-1679
https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73@%3Cj-users.xerces.apache.org%3E
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
http://support.apple.com/kb/HT5982
http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch
https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
http://www-01.ibm.com/support/docview.wss?uid=swg1IC98015
http://www-01.ibm.com/support/docview.wss?uid=swg21644197
http://www-01.ibm.com/support/docview.wss?uid=swg21653371
http://www-01.ibm.com/support/docview.wss?uid=swg21657539
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002
http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013
http://www.ibm.com/support/docview.wss?uid=swg21648172
http://www.ubuntu.com/usn/USN-2033-1
http://www.ubuntu.com/usn/USN-2089-1
cpuapr2022.html Other https://www.oracle.com/security-alerts/cpuapr2022.html
CVE-2013-4002 https://nvd.nist.gov/vuln/detail/CVE-2013-4002
glsa-201406-32.xml Advisory http://security.gentoo.org/glsa/glsa-201406-32.xml
msg00000.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
msg00003.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html
msg00026.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
msg00027.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
msg00028.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
msg00029.html Advisory http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
RHSA-2013-1059.html Advisory http://rhn.redhat.com/errata/RHSA-2013-1059.html
RHSA-2013-1060.html Advisory http://rhn.redhat.com/errata/RHSA-2013-1060.html
RHSA-2013-1081.html Advisory http://rhn.redhat.com/errata/RHSA-2013-1081.html
RHSA-2014:0414 Advisory https://access.redhat.com/errata/RHSA-2014:0414
RHSA-2015-0773.html http://rhn.redhat.com/errata/RHSA-2015-0773.html
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.