QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2014-0107

Back to search

CVE-2014-0107

Published: Apr 15, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

VendorProductVersions

n/a

n/a

affected
n/a

References

GLSA-201604-02
vendor-advisory
x_refsource_GENTOO
59291
third-party-advisory
x_refsource_SECUNIA
59290
third-party-advisory
x_refsource_SECUNIA
RHSA-2015:1888
vendor-advisory
x_refsource_REDHAT
59151
third-party-advisory
x_refsource_SECUNIA
59247
third-party-advisory
x_refsource_SECUNIA
59515
third-party-advisory
x_refsource_SECUNIA
DSA-2886
vendor-advisory
x_refsource_DEBIAN
60502
third-party-advisory
x_refsource_SECUNIA
59369
third-party-advisory
x_refsource_SECUNIA
59711
third-party-advisory
x_refsource_SECUNIA
57563
third-party-advisory
x_refsource_SECUNIA
66397
vdb-entry
x_refsource_BID
1034711
vdb-entry
x_refsource_SECTRACK
1034716
vdb-entry
x_refsource_SECTRACK
RHSA-2014:1351
vendor-advisory
x_refsource_REDHAT
RHSA-2014:0348
vendor-advisory
x_refsource_REDHAT
59036
third-party-advisory
x_refsource_SECUNIA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now