Skip to content
OpenAdvisories
Unscored DSA-2842-1 2 CVEs

libspring-java - several

Published Jan 13, 2014 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 libspring-java 3.0.6.RELEASE-6+deb7u1

Vulnerabilities 2

  • Medium —
    CVE-2013-4152 EPSS 26%

    Cross-Site Request Forgery in Spring Framework

    The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-7315

    Missing XML Validation in Spring Framework

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…

    libspring-java org.springframework:spring-oxm Debian Maven