Description
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jakarta-taglibs-standard | 1.1.2-3ubuntu1 | — |
| Ubuntu 14.04 LTS | jakarta-taglibs-standard | 1.1.2-2ubuntu1.14.04.1 | USN-2551-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | jakarta-taglibs-standard | 1.1.2-14.el7_1 | RHSA-2015:1695 |
| RHEL 7 | jakarta-taglibs-standard-javadoc | 1.1.2-14.ael7b_1 | RHSA-2015:1695 |
| RHEL 6 | jakarta-taglibs-standard +1 | 1.1.1-11.7.el6_7 | RHSA-2015:1695 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +14 | 1.1.0-15.SP18_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.1.6-1.redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.2.1-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.2-2.GA_redhat_1.ep7.el6 | RHSA-2016:1840 |
| Red Hat JBoss EAP 7 | eap7-jboss-jstl-api_1.2_spec | 1.1.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jboss-security-negotiation | 3.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jbossws-common | 3.1.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.1.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.1.2-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.10-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.3.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 4.9.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-3.SP3_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-resteasy +17 | 3.0.18-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.3.24-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.2-2.GA_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.2-1.GA_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-wildfly-web-console-eap | 2.8.27-1.Final_redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.1.5-1.redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-xalan-j2 | 2.7.1-25.redhat_11.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.0.6-1.redhat_1.1.ep7.el6 | RHSA-2016:1839, RHSA-2016:1838 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.7.18-1.redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | hibernate4-eap6 +4 | 4.2.22-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | hibernate4-validator | 4.3.2-3.Final_redhat_3.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-10.SP8_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | httpserver | 1.0.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.17-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.35-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.6-1.Final_redhat_2.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.6-1.Final_redhat_1.ep6.el6 | RHSA-2016:0124 |
| Red Hat JBoss EAP 6 | jboss-jstl-api_1.2_spec | 1.0.9-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jboss-remoting3 | 3.3.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.6-2.Final_redhat_2.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.3.6-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.19-3.redhat_2.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.8-1.redhat_1.1.ep6.el5 | RHSA-2016:0123, RHSA-2016:0122, RHSA-2016:0121 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | jakarta-taglibs-standard | 1.1.1-255.2 | SUSE-SU-2017:1568-1 |
| SLES 11 SP4 | jakarta-taglibs-standard | 1.1.1-234.31.1 | SUSE-SU-2017:1701-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | jakarta-taglibs-standard | 1.1.1-255.2 | SUSE-SU-2017:1568-1 |
| SLES for SAP 11 SP4 | jakarta-taglibs-standard | 1.1.1-234.31.1 | SUSE-SU-2017:1701-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | jakarta-taglibs-standard +1 | 1.1.2-14.el7_1 | ELSA-2015-1695 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.taglibs:taglibs-standard | < 1.2.3 | 1.2.3 | GHSA-6x4w-8w53-xrvv |
| Maven | org.apache.taglibs:taglibs-standard-impl | < 1.2.3 | 1.2.3 | GHSA-6x4w-8w53-xrvv |
Advisories 12
- RHSA-2016:1839 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.2 for RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1840 Red Hat Security Advisory: eap7-jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:1838 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.0.2 on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0124 Red Hat Security Advisory: jboss-ec2-eap security and enhancement update for EAP 6.4.6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0123 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0121 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 5 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0122 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.6 update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1695 Red Hat Security Advisory: jakarta-taglibs-standard security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-2551-1 jakarta-taglibs-standard vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2017:1701-1 Security update for jakarta-taglibs-standard SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1568-1 Security update for jakarta-taglibs-standard SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-1695 Important: jakarta-taglibs-standard security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 31, 2015
References
- USN-2551-1 vendor-advisory
- RHSA-2016:1376 vendor-advisory
- RHSA-2016:1841 vendor-advisory
- [tomcat-taglibs-user] 20150227 [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags mailing-list
- RHSA-2016:1838 vendor-advisory
- 20150227 [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags mailing-list
- RHSA-2015:1695 vendor-advisory
- RHSA-2016:1839 vendor-advisory
- openSUSE-SU-2015:1751 vendor-advisory
- 72809 vdb-entry
- RHSA-2016:1840 vendor-advisory
- 1034934 vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [27/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [27/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- [portals-pluto-dev] 20210714 [jira] [Closed] (PLUTO-792) Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254 mailing-list
- [portals-pluto-scm] 20210714 [portals-pluto] branch master updated: PLUTO-792 Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254 mailing-list
- [portals-pluto-dev] 20210714 [jira] [Created] (PLUTO-792) Upgrade to taglibs-standard-impl-1.2.3 due to CVE-2015-0254 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html