Red Hat Security AdvisoryRHSA-2014:0348
xalan-j2 security update
Released 2014-04-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) xalan-j2-2.7.0-6jpp.2, xalan-j2-2.7.0-6jpp.2.i386, xalan-j2-2.7.0-6jpp.2.ia64 +17
- Red Hat Enterprise Linux Desktop (v. 5 client) xalan-j2-2.7.0-6jpp.2, xalan-j2-2.7.0-6jpp.2.i386, xalan-j2-manual-2.7.0-6jpp.2 +3
- Red Hat Enterprise Linux Desktop Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xalan-j2-2.7.0-6jpp.2, xalan-j2-demo-2.7.0-6jpp.2, xalan-j2-demo-2.7.0-6jpp.2.i386 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
- Red Hat Enterprise Linux Server (v. 6) xalan-j2-2.7.0-9.9.el6_5
- Red Hat Enterprise Linux Server Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
- Red Hat Enterprise Linux Workstation (v. 6) xalan-j2-2.7.0-9.9.el6_5
- Red Hat Enterprise Linux Workstation Optional (v. 6) xalan-j2-2.7.0-9.9.el6_5, xalan-j2-demo-2.7.0-9.9.el6_5, xalan-j2-javadoc-2.7.0-9.9.el6_5 +2
Fixes 1 record
Priority MEDIUM 48
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions an…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.14066 · Published 2014-04-15 · Partial fix · 2.7.2 CWE-264
