Summary
David Jorm discovered that the Apache Standard Taglibs incorrectly handled
external XML entities. A remote attacker could possibly use this issue to
execute arbitrary code or perform other external XML entity attacks.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | jakarta-taglibs-standard | 1.1.2-2ubuntu1.14.04.1 |
Vulnerabilities 1
-
High —CVE-2015-0254 EPSS 12%
XXE in Apache Standard Taglibs
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
References
-
report
https://ubuntu.com/security/CVE-2015-0254