Homepage

xerces:xercesImpl@2.3.0 vulnerabilities

  • latest version

    2.12.2

  • latest non vulnerable version

    2.12.2

  • first published

    19 years ago

  • latest version published

    3 years ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the xerces:xercesImpl package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Denial of Service (DoS)

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS) via the XML parser when handling specially crafted XML document payloads. When the parser tries to parse such a document it gets stuck in an infinite loop for a long time, which consumes resources.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.12.2 or higher.

    [0,2.12.2)
    • M
    Improper Input Validation

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Improper Input Validation due to the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code.

    How to fix Improper Input Validation?

    Upgrade xerces:xercesImpl to version 2.12.0.SP03 or higher.

    [,2.12.0.SP03)
    • M
    Denial of Service (DoS)

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS). Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.12.0 or higher.

    [,2.12.0)
    • M
    Denial of Service (DoS)

    xerces:xercesImpl is an that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS). XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.10.0 or higher.

    [,2.10.0)
    • H
    Denial of Service (DoS)

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS). Apache Xerces2 Java allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.12.0 or higher.

    [0,2.12.0)
    • M
    Denial of Service (DoS)

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker may be able to force the target server to parse an FTP URL, which points to an FTP server controller by the attacker. When the target server is mid way through fetching the FTP resources, the attackers malicious FTP server will exit the process and will leave the thread hanging in the target server.

    It is possible to conduct this attack only if the following conditions are met:

    • An attacker can pass an URL parameter that points to a controlled FTP server to the target.
    • Target server uses vulnerable component(s) to fetch the resource specified by the attacker.
    • Target server does not prevent fetching of FTP URI resources.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.11.0 or higher.

    [,2.11.0)
    • M
    Denial of Service (DoS)

    xerces:xercesImpl is a that is used for high performance, fully compliant XML parsers in the Apache Xerces family.

    Affected versions of this package are vulnerable to Denial of Service (DoS) which is caused by the way the JRE processes XML files. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.

    How to fix Denial of Service (DoS)?

    Upgrade xerces:xercesImpl to version 2.11.0.SP5 or higher.

    [,2.11.0.SP5)
    Go back to all versions of this package