Homepage

Access Restriction Bypass The advisory has been revoked - it doesn't affect any version of package libxalan2-java  (opens in a new tab)

Threat Intelligence

EPSS
14.07% (97th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-LIBXALAN2JAVA-633124
  • published15 Apr 2014
  • disclosed15 Apr 2014
Report a new vulnerability Found a mistake?

Introduced: 15 Apr 2014

CVE-2014-0107  (opens in a new tab)
CWE-264  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxalan2-java package and not the libxalan2-java package as distributed by Ubuntu.

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

References