Skip to content
OpenAdvisories
Unscored RHSA-2014:0453 1 CVE

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 xalan-j2-eap6 0:2.7.1-9.redhat_7.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 xalan-j2-eap6 0:2.7.1-9.redhat_7.1.ep6.el6

Vulnerabilities 1

  • High —
    CVE-2014-0107 EPSS 14%

    Improper Authorization in Apache Xalan-Java

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access exte…

    xalan:xalan libxalan2-java Debian Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1080248
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0453.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0107
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0107
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0107
  • article
    http://www.ocert.org/advisories/ocert-2014-002.html