Description
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | xerces-j2 +2 | 2.11.0-17.el7_0 | RHSA-2014:1319 |
| RHEL 6 | java-1.5.0-ibm +6 | 1:1.5.0.16.3-1jpp.1.el6_4 | RHSA-2013:1081 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.14.0-1jpp.1.el6_4 | RHSA-2013:1059 |
| RHEL 6 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.65.1.11.14.el6_4 | RHSA-2013:1505 |
| RHEL 6 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el6_4 | RHSA-2013:1060 |
| RHEL 6 | java-1.7.0-openjdk +4 | 1:1.7.0.45-2.4.3.2.el6_4 | RHSA-2013:1451 |
| RHEL 6 | java-1.7.0-oracle +5 | 1:1.7.0.45-1jpp.2.el6_4 | RHSA-2013:1440 |
| RHEL 6 | xerces-j2 +6 | 2.7.1-12.7.el6_5 | RHSA-2014:1319 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.16.3-1jpp.1.el5_9 | RHSA-2013:1081 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.14.0-1jpp.1.el5_9 | RHSA-2013:1059 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.42.1.11.14.el5_10 | RHSA-2013:1505 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.5.0-1jpp.2.el5_9 | RHSA-2013:1060 |
| RHEL 5 | java-1.7.0-openjdk +4 | 1:1.7.0.45-2.4.3.1.el5_10 | RHSA-2013:1447 |
| RHEL 5 | java-1.7.0-oracle +5 | 1:1.7.0.45-1jpp.1.el5_10 | RHSA-2013:1440 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.1.el6_5 | RHSA-2014:0414 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.75-1jpp.3.el5_10 | RHSA-2014:0414 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.12-1.SP1_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.14-9.SP4_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | javassist-eap6 | 3.18.1-5.GA_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-as-ee +60 | 7.4.2-3.Final_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.2.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.5.2-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-metadata +5 | 7.1.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-remoting3-jmx | 1.1.3-1.Final_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jboss-xnio-base | 3.0.11-1.GA_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jbossas-javadocs +1 | 7.4.2-2.Final_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jbossws-common | 2.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.1-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | netty | 3.6.10-1.Final_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | picketlink-bindings | 2.5.3-11.SP12_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.5.3-12.SP12_redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.8-10.SP3_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.25-1.Final_redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.16-1.redhat_2.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | xerces-j2-eap6 | 2.9.1-17.redhat_6.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | xjc-utils +4 | 2.6.2-3.redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.7-2.redhat_1.1.ep6.el5 | RHSA-2014:1822, RHSA-2014:1821, RHSA-2014:1818 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | xerces-j2 +2 | 2.11.0-17.el7_0 | ELSA-2014-1319 |
| Oracle Linux 7 | xerces-j2-scripts +4 | 2.7.1-12.7.el6_5 | ELSA-2014-1319 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
tafamace/CVE-2013-4002 ★ 0 · Nov 19, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | xerces:xercesImpl | < 2.12.0 | 2.12.0 | GHSA-7j4h-8wpf-rqfh |
Advisories 18
- RHSA-2014:1822 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1821 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1818 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1319 Red Hat Security Advisory: xerces-j2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0414 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1505 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1447 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1451 Red Hat Security Advisory: java-1.7.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1440 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1081 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1059 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1060 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2024-0068 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- WID-SEC-2023-1376 IBM Java Runtime: Mehrere Schwachstellen gefährden die Integrität, Vertraulichkeit und Verfügbarkeit BSI CERT-Bund (WID) · Jun 6, 2023
- ELSA-2014-1319 Moderate: xerces-j2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 29, 2014
References
- IC98015 vendor-advisory
- RHSA-2013:1060 vendor-advisory
- RHSA-2014:0414 vendor-advisory
- GLSA-201406-32 vendor-advisory
- RHSA-2013:1447 vendor-advisory
- RHSA-2015:0765 vendor-advisory
- RHSA-2013:1440 vendor-advisory
- RHSA-2015:0675 vendor-advisory
- 61310 vdb-entry
- RHSA-2015:0773 vendor-advisory
- RHSA-2015:0720 vendor-advisory
- SUSE-SU-2013:1257 vendor-advisory
- USN-2033-1 vendor-advisory
- USN-2089-1 vendor-advisory
- SUSE-SU-2013:1256 vendor-advisory
- HPSBUX02944 vendor-advisory
- RHSA-2013:1505 vendor-advisory
- HPSBUX02943 vendor-advisory
- RHSA-2014:1822 vendor-advisory
- 56257 third-party-advisory
- SUSE-SU-2013:1263 vendor-advisory
- RHSA-2013:1059 vendor-advisory
- RHSA-2014:1823 vendor-advisory
- openSUSE-SU-2013:1663 vendor-advisory
- SUSE-SU-2013:1666 vendor-advisory
- APPLE-SA-2013-10-15-1 vendor-advisory
- SUSE-SU-2013:1293 vendor-advisory
- RHSA-2013:1081 vendor-advisory
- [j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available mailing-list
- SUSE-SU-2013:1255 vendor-advisory
- RHSA-2013:1451 vendor-advisory
- RHSA-2014:1818 vendor-advisory
- RHSA-2014:1821 vendor-advisory
- SUSE-SU-2013:1305 vendor-advisory
- ibm-java-cve20134002-dos(85260) vdb-entry
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1 mailing-list
- https://www.oracle.com/security-alerts/cpuapr2022.html
- http://www.ibm.com/support/docview.wss?uid=swg21648172
- http://www-01.ibm.com/support/docview.wss?uid=swg21657539
- https://issues.apache.org/jira/browse/XERCESJ-1679
- http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch
- http://www-01.ibm.com/support/docview.wss?uid=swg21644197
- http://www-01.ibm.com/support/docview.wss?uid=swg21653371
- http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013
- http://support.apple.com/kb/HT5982
- https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
- http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002
- http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html