{"id":"CVE-2014-0107","aliases":["DEBIAN-CVE-2014-0107","DSA-2886-1","EUVD-2022-5145","GHSA-rc2w-r4jq-7pfx","MGASA-2014-0152","RHSA-2014:0348","RHSA-2014:0453","RHSA-2014:0591","UBUNTU-CVE-2014-0107","openSUSE-SU-2024:10404-1"],"status":"published","title":"Improper Authorization in Apache Xalan-Java","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.14066,"percentile":0.96586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-285"],"published":"2014-03-26T00:00:00Z","modified":"2026-10-23T15:47:27Z","fixes":[{"ecosystem":"Maven","package":"xalan:xalan","fixed_in":["2.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"libxalan2-java","fixed_in":["2.7.1-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxalan2-java","fixed_in":["2.7.1-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxalan2-java","fixed_in":["2.7.1-9"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libxalan2-java","fixed_in":["2.7.1-5+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libxalan2-java","fixed_in":["2.7.1-7+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"xalan-j2","fixed_in":["2.7.1-5.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"xalan-j2","fixed_in":["2.7.1-6.1.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-debuginfo","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-manual","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-debuginfo","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-demo","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-debuginfo","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-demo","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-manual","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-6jpp.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-demo","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-manual","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-demo","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-manual","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-demo","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-manual","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-demo","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-javadoc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-manual","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-xsltc","fixed_in":["0:2.7.0-9.9.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xalan-j2-eap6","fixed_in":["0:2.7.1-9.redhat_7.1.ep6.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xalan-j2-eap6","fixed_in":["0:2.7.1-9.redhat_7.1.ep6.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"xalan-j2","fixed_in":["0:2.7.1-12_patch_08.ep5.el4"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"xalan-j2","fixed_in":["0:2.7.1-12_patch_08.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"xalan-j2","fixed_in":["0:2.7.1-12_patch_08.ep5.el6"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xalan-j2","fixed_in":["2.7.2-5.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"xalan:xalan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxalan2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxalan2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxalan2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libxalan2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-5+deb6u1"}]}],"versions":["2.7.1-5"]},{"source":"osv","ecosystem":"Debian:7","package":"libxalan2-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-7+deb7u1"}]}],"versions":["2.7.1-7"]},{"source":"osv","ecosystem":"Maven","package":"xalan:xalan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2"}]}],"versions":["2.1.0","2.3.1","2.4.0","2.4.1","2.5.0","2.5.1","2.5.D1","2.6.0","2.7.0","2.7.1"]},{"source":"osv","ecosystem":"Mageia:3","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-5.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-6.1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-6jpp.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"xalan-j2-xsltc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-9.9.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el5","package":"xalan-j2-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-9.redhat_7.1.ep6.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:6::el6","package":"xalan-j2-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-9.redhat_7.1.ep6.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el4","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12_patch_08.ep5.el4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12_patch_08.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12_patch_08.ep5.el6"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-5.4"}]}]}],"products":[{"vendor":"apache","product":"xalan-java"},{"vendor":"oracle","product":"webcenter_sites"}],"references":[{"url":"https://security.gentoo.org/glsa/201604-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59291","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59290","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1888.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59151","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59247","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59515","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2886","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/60502","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59369","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59711","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/57563","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/66397","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034711","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034716","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1351.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0348.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/59036","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/92023","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://issues.apache.org/jira/browse/XALANJ-2435","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21676093","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ibm.com/support/docview.wss?uid=swg21677967","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.tenable.com/security/tns-2018-15","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21677145","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21681933","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21674334","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ocert.org/advisories/ocert-2014-002.html","tags":["x_refsource_MISC","x_transferred","US Government Resource","advisory","web","article"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1581058","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21680703","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0107","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0c00afcab8f238562e27b3ae7b8af1913c62bc60838fb8b34c19e26b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2900489bc665a2e32d021bb21f6ce2cb8e6bb5973490eebb9a346bca@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rc2w-r4jq-7pfx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0107","tags":["advisory"]},{"url":"https://github.com/apache/xalan-java","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0152.html","tags":["advisory"]},{"url":"https://www.debian.org/security/2014/dsa-2886","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13104","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0348","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1080248","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0348.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0107","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0453","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0453.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0591","tags":["advisory"]},{"url":"https://issues.jboss.org/browse/JBPAPP-10991","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0591.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0107","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2218-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0107","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2014-04-15T17:00:00Z","modified":"2024-08-06T09:05:38.816Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2022-5145","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2014-04-15T17:00:00Z","modified":"2024-08-06T09:05:38Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-rc2w-r4jq-7pfx","title":"Improper Authorization in Apache Xalan-Java","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2022-05-13T01:05:38Z","modified":"2025-04-13T23:22:03Z","cwes":["CWE-285"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2014-04-15T23:13:13.07Z","modified":"2026-06-17T00:02:17.223Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2014-04-15T23:13:13Z","modified":"2026-04-16T06:21:51.440187354Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2014-04-15T23:13:13.07Z","modified":"2026-10-23T15:47:27.297685163Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2886-1","title":"libxalan2-java - security update","status":"published","published":"2014-03-26T00:00:00Z","modified":"2026-03-09T01:19:09.306976Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-rc2w-r4jq-7pfx","title":"Improper Authorization in Apache Xalan-Java","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"published","published":"2022-05-13T01:05:38Z","modified":"2025-04-13T23:37:05.40219Z","cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"MGASA-2014-0152","title":"Updated xalan-j2 packages fix CVE-2014-0107","description":"Updated xalan-j2 packages fix security vulnerability:\n\nNicolas Gregoire discovered several vulnerabilities in libxalan2-java.\nCrafted XSLT programs could access system properties or load arbitrary\nclasses, resulting in information disclosure and, potentially, arbitrary\ncode execution (CVE-2014-0107).\n","status":"published","published":"2014-04-03T00:50:42Z","modified":"2026-04-16T06:24:58.949629023Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10404-1","title":"xalan-j2-2.7.2-5.4 on GA media","description":"These are all security issues fixed in the xalan-j2-2.7.2-5.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:24.189841Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2014:0348","title":"Red Hat Security Advisory: xalan-j2 security update","status":"published","published":"2024-09-15T21:35:56Z","modified":"2026-08-05T10:02:29Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2014:0453","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 security update","status":"published","published":"2024-09-15T21:36:21Z","modified":"2026-08-05T10:02:33Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0591","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-15T21:36:31Z","modified":"2026-08-05T10:02:35Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-0107","description":"The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.","status":"withdrawn","published":"2014-04-15T00:00:00Z","modified":"2026-02-04T03:30:30.224226Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}