CVE-2013-4002

CWE-20 — Improper Input ValidationCWE-11211 documents7 sources
Severity
7.1HIGH
EPSS
5.6%
top 9.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Apache Xerces2 JavaOracle JrockitCanonical Ubuntu Linux+12 more
Timeline
PublishedJul 23
Latest updateMay 13

Description

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to X…

CVSS vector

AV:N/AC:M/C:N/I:N/A:CExploitability: 8.6 | Impact: 6.9

Affected Packages15 packages

▶NVDapache/xerces2_java2.4.0 — 2.12.0
▶NVDibm/java43 versions+42
▶NVDoracle/jrockitr27.7.0 — r27.7.6+1
▶NVDoracle/jdk1.5.0, 1.6.0, 1.7.0+2

Also affects: Ubuntu Linux 10.04, 12.04, 12.10, 13.04, 13.10

Patches

Patch: svn.apache.org ↗Patch: svn.apache.org ↗

🔴Vulnerability Details

3
GHSA
Missing XML Validation in Apache Xerces2↗2022-05-13
▶
OSV
Missing XML Validation in Apache Xerces2↗2022-05-13
▶
CVEList
CVE-2013-4002: XMLscanner↗2013-07-23
▶

📋Vendor Advisories

3
Ubuntu
OpenJDK 7 vulnerabilities↗2014-01-23
▶
Ubuntu
OpenJDK 6 vulnerabilities↗2013-11-21
▶
Red Hat
OpenJDK: XML parsing Denial of Service (JAXP, 8017298)↗2013-10-15
▶

💬Community

4
Bugzilla
CVE-2013-4002 wildfly: Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298) [fedora-all]↗2016-09-13
▶
Bugzilla
CVE-2013-4002 xerces-j2: Xerces-J2 OpenJDK: XML parsing Denial of Service (JAXP, 8017298) [fedora-all]↗2014-09-10
▶
Bugzilla
CVE-2013-4002 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)↗2013-10-15
▶
Bugzilla
CVE-2013-3006 CVE-2013-3007 CVE-2013-3008 CVE-2013-3009 CVE-2013-3010 CVE-2013-3011 CVE-2013-3012 IBM JDK: Unspecified security fixes (July 2013)↗2013-07-17
▶
CVE-2013-4002 (HIGH CVSS 7.1) | XMLscanner.java in Apache Xerces2 J | cvebase.io