Description
The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.6.0-bea +5 | 1:1.6.0.03-1jpp.2.el5 | RHSA-2008:0245 |
Advisories 1
- RHSA-2008:0245 Red Hat Security Advisory: java-1.6.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 29841 third-party-advisory
- RHSA-2008:0245 vendor-advisory
- 27553 vdb-entry
- oval:org.mitre.oval:def:9847 vdb-entry signature
- BEA08-201.00 vendor-advisory
- 20080202 Sun JRE / JDK bug introduces XXE possibilities mailing-list
- GLSA-200804-28 vendor-advisory
- 28746 third-party-advisory
- 3621 third-party-advisory
- 29858 third-party-advisory
- http://scary.beasts.org/security/CESA-2007-002.html
- ADV-2008-1252 vdb-entry
- 30780 third-party-advisory
- ADV-2008-0371 vdb-entry
- 231246 vendor-advisory
- GLSA-200804-20 vendor-advisory
- GLSA-200806-11 vendor-advisory
- 1019292 vdb-entry