NVD

Id
29041  
Name
CVE-2014-0107  
Description
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-04-15  
Modified Date
2017-01-06  
Seq
2014-0107  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153342 29041 CVE-2014-0107 RHSA-2014:1351  View
153343 29041 CVE-2014-0107 59151  View
153344 29041 CVE-2014-0107 59247  View
153345 29041 CVE-2014-0107 59290  View
153346 29041 CVE-2014-0107 59291  View
153347 29041 CVE-2014-0107 59515  View
153348 29041 CVE-2014-0107 http://svn.apache.org/viewvc?view=revision&revision=1581058  View
153349 29041 CVE-2014-0107 http://www-01.ibm.com/support/docview.wss?uid=swg21674334  View
153350 29041 CVE-2014-0107 http://www-01.ibm.com/support/docview.wss?uid=swg21676093  View
153351 29041 CVE-2014-0107 http://www-01.ibm.com/support/docview.wss?uid=swg21677145  View
153352 29041 CVE-2014-0107 http://www-01.ibm.com/support/docview.wss?uid=swg21680703  View
153353 29041 CVE-2014-0107 http://www-01.ibm.com/support/docview.wss?uid=swg21681933  View
153354 29041 CVE-2014-0107 http://www.ibm.com/support/docview.wss?uid=swg21677967  View
153355 29041 CVE-2014-0107 http://www.ocert.org/advisories/ocert-2014-002.html  View
153356 29041 CVE-2014-0107 http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html  View
153357 29041 CVE-2014-0107 66397  View
153358 29041 CVE-2014-0107 apache-xalanjava-cve20140107-sec-bypass(92023)  View
153359 29041 CVE-2014-0107 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755  View
153360 29041 CVE-2014-0107 https://issues.apache.org/jira/browse/XALANJ-2435  View
153361 29041 CVE-2014-0107 GLSA-201604-02  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13268 JVNDB-2014-002143 Apache Xalan-Java の TransformerFactory における期待した制限を回避される脆弱性 Apache Xalan-Java の TransformerFactory は、FEATURE_SECURE_PROCESSING が有効な場合、特定のプロパティを適切に制限しないため、期待した制限を回避され、任意のクラスをロードされる、または外部リソースにアクセスされる脆弱性が存在します。 CVE-2014-0107 67508 CVE-2014-0107 29041 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002143.html 2014-03-25 2016-01-28 View