Skip to content
OpenAdvisories
Unscored RHSA-2014:0591 1 CVE

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

Published Sep 15, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el4 xalan-j2 0:2.7.1-12_patch_08.ep5.el4
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el5 xalan-j2 0:2.7.1-12_patch_08.ep5.el5
Red Hat · JBoss EAP 5 jboss_enterprise_application_platform:5::el6 xalan-j2 0:2.7.1-12_patch_08.ep5.el6

Vulnerabilities 1

  • High —
    CVE-2014-0107 EPSS 14%

    Improper Authorization in Apache Xalan-Java

    The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access exte…

    xalan:xalan libxalan2-java Debian Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://issues.jboss.org/browse/JBPAPP-10991
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1080248
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0591.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0107
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0107
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0107
  • article
    http://www.ocert.org/advisories/ocert-2014-002.html