Summary
[0:1.1.1-11.7]
- Gracefully handle parsers without FSP support (e.g. Java 5 GCJ)
- Resolves: CVE-2015-0254
[0:1.1.1-11.6]
- Prevent XXE and RCE in JSTL XML tags
- Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>)
- Resolves: CVE-2015-0254
[0:1.1.1-11.5]
- Prevent XXE and RCE in JSTL XML tags
- Resolves: CVE-2015-0254
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | jakarta-taglibs-standard | 0:1.1.2-14.el7_1 |
| Oracle Linux · 7 | jakarta-taglibs-standard-javadoc | 0:1.1.2-14.el7_1 |
Vulnerabilities 1
-
High —CVE-2015-0254 EPSS 12%
XXE in Apache Standard Taglibs
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.