Skip to content
OpenAdvisories
Unscored DSA-2890-1 2 CVEs

libspring-java - security update

Published Mar 29, 2014 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 7 libspring-java 3.0.6.RELEASE-6+deb7u3

Vulnerabilities 2

  • Medium —
    CVE-2014-0054 EPSS 91%

    Cross-Site Request Forgery in Spring Framework

    The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF atta…

    libspring-java org.springframework:spring-webmvc Debian Maven
  • Medium —
    CVE-2014-1904

    Improper Neutralization of Input During Web Page Generation in Spring Framework

    Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

    libspring-java org.springframework:spring-webmvc Debian Maven