Skip to content
OpenAdvisories
Unscored RHSA-2014:0348 1 CVE

Red Hat Security Advisory: xalan-j2 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 34

ReleasePackageFixed in
Red Hat · RHEL 5 enterprise_linux:5::client xalan-j2 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client xalan-j2-debuginfo 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client xalan-j2-manual 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client xalan-j2-xsltc 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xalan-j2 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xalan-j2-debuginfo 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xalan-j2-demo 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::client_workstation xalan-j2-javadoc 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2-debuginfo 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2-demo 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2-javadoc 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2-manual 0:2.7.0-6jpp.2
Red Hat · RHEL 5 enterprise_linux:5::server xalan-j2-xsltc 0:2.7.0-6jpp.2
Red Hat · RHEL 6 enterprise_linux:6::client xalan-j2 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client xalan-j2-demo 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client xalan-j2-javadoc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client xalan-j2-manual 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::client xalan-j2-xsltc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode xalan-j2 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode xalan-j2-demo 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode xalan-j2-javadoc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode xalan-j2-manual 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::computenode xalan-j2-xsltc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server xalan-j2 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server xalan-j2-demo 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server xalan-j2-javadoc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server xalan-j2-manual 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::server xalan-j2-xsltc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation xalan-j2 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation xalan-j2-demo 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation xalan-j2-javadoc 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation xalan-j2-manual 0:2.7.0-9.9.el6_5
Red Hat · RHEL 6 enterprise_linux:6::workstation xalan-j2-xsltc 0:2.7.0-9.9.el6_5

Vulnerabilities 1

  • High —
    CVE-2014-0107 EPSS 14%

    Improper Authorization in Apache Xalan-Java

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access exte…

    xalan:xalan libxalan2-java Debian Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1080248
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0348.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0107
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0107
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0107
  • article
    http://www.ocert.org/advisories/ocert-2014-002.html