CVE-2014-0107
Improper Authorization in Apache Xalan-Java
CVE-2014-0107 is a high vulnerability (CVSS 7.5) in Apache Xalan-java, published March 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.1%, the 96th percentile. Fixed in xalan:xalan 2.7.2.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 14.1%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.7.2xalan:xalan +50 more
Description
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xalan:xalanMaven | before 2.7.2 | 2.7.2 |
xalan:xalanTuxCare:Maven | 2.7.0 up to 2.7.0-tuxcare.2, plus listed versions 2.7.0-tuxcare.1 | 2.7.0-tuxcare.2 |
xalan:xalanTuxCare:Maven | 2.7.1 up to 2.7.1-tuxcare.2, plus listed versions 2.7.1-tuxcare.1 | 2.7.1-tuxcare.2 |
libxalan2-javaDebian:12 | before 2.7.1-9 | 2.7.1-9 |
libxalan2-javaDebian:13 | before 2.7.1-9 | 2.7.1-9 |
libxalan2-javaDebian:14 | before 2.7.1-9 | 2.7.1-9 |
libxalan2-javaDebian:6.0 | before 2.7.1-5+deb6u1, plus listed versions 2.7.1-5 | 2.7.1-5+deb6u1 |
libxalan2-javaDebian:7 | before 2.7.1-7+deb7u1, plus listed versions 2.7.1-7 | 2.7.1-7+deb7u1 |
xalan:xalanMaven | before 2.7.2, plus listed versions 2.1.02.3.12.4.02.4.12.5.0 Show 5 moreShow less2.5.12.5.D12.6.02.7.02.7.1 | 2.7.2 |
xalan-j2Mageia:3 | before 2.7.1-5.1.mga3 | 2.7.1-5.1.mga3 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xalan-j2Mageia:4 | before 2.7.1-6.1.mga4 | 2.7.1-6.1.mga4 |
xalan-j2Red Hat:enterprise_linux:5::client | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-debuginfoRed Hat:enterprise_linux:5::client | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-manualRed Hat:enterprise_linux:5::client | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-xsltcRed Hat:enterprise_linux:5::client | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2Red Hat:enterprise_linux:5::client_workstation | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-demoRed Hat:enterprise_linux:5::client_workstation | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-javadocRed Hat:enterprise_linux:5::client_workstation | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2Red Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-debuginfoRed Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-demoRed Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-javadocRed Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-manualRed Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2-xsltcRed Hat:enterprise_linux:5::server | before 0:2.7.0-6jpp.2 | 0:2.7.0-6jpp.2 |
xalan-j2Red Hat:enterprise_linux:6::client | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-demoRed Hat:enterprise_linux:6::client | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-javadocRed Hat:enterprise_linux:6::client | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-manualRed Hat:enterprise_linux:6::client | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-xsltcRed Hat:enterprise_linux:6::client | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2Red Hat:enterprise_linux:6::computenode | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-demoRed Hat:enterprise_linux:6::computenode | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-javadocRed Hat:enterprise_linux:6::computenode | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-manualRed Hat:enterprise_linux:6::computenode | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-xsltcRed Hat:enterprise_linux:6::computenode | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2Red Hat:enterprise_linux:6::server | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-demoRed Hat:enterprise_linux:6::server | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-javadocRed Hat:enterprise_linux:6::server | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-manualRed Hat:enterprise_linux:6::server | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-xsltcRed Hat:enterprise_linux:6::server | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2Red Hat:enterprise_linux:6::workstation | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-demoRed Hat:enterprise_linux:6::workstation | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-javadocRed Hat:enterprise_linux:6::workstation | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-manualRed Hat:enterprise_linux:6::workstation | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-xsltcRed Hat:enterprise_linux:6::workstation | before 0:2.7.0-9.9.el6_5 | 0:2.7.0-9.9.el6_5 |
xalan-j2-eap6Red Hat:jboss_enterprise_application_platform:6::el5 | before 0:2.7.1-9.redhat_7.1.ep6.el5 | 0:2.7.1-9.redhat_7.1.ep6.el5 |
xalan-j2-eap6Red Hat:jboss_enterprise_application_platform:6::el6 | before 0:2.7.1-9.redhat_7.1.ep6.el6 | 0:2.7.1-9.redhat_7.1.ep6.el6 |
xalan-j2Red Hat:jboss_enterprise_application_platform:5::el4 | before 0:2.7.1-12_patch_08.ep5.el4 | 0:2.7.1-12_patch_08.ep5.el4 |
xalan-j2Red Hat:jboss_enterprise_application_platform:5::el5 | before 0:2.7.1-12_patch_08.ep5.el5 | 0:2.7.1-12_patch_08.ep5.el5 |
xalan-j2Red Hat:jboss_enterprise_application_platform:5::el6 | before 0:2.7.1-12_patch_08.ep5.el6 | 0:2.7.1-12_patch_08.ep5.el6 |
xalan-j2openSUSE:Tumbleweed | before 2.7.2-5.4 | 2.7.2-5.4 |
What each source reports
NVD Score used
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
CVE-2014-0107- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
CVE-2014-0107- Updated
- 2026-11-02
EUVDEUVD-2022-5145No score
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
EUVD-2022-5145- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc2w-r4jq-7pfxNo score
Improper Authorization in Apache Xalan-Java
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
GHSA-rc2w-r4jq-7pfx- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVCLSA-2026-1794397314No score
TuxCare security update for xalan:xalan (1 CVE)
TuxCare rebuilt xalan:xalan to address 1 CVE. Fixed in 2.7.0-tuxcare.2.
- Record
CLSA-2026-1794397314- Updated
- 2026-11-11
OSVCLSA-2026-1794592346No score
TuxCare security update for xalan:xalan (1 CVE)
TuxCare rebuilt xalan:xalan to address 1 CVE. Fixed in 2.7.1-tuxcare.2.
- Record
CLSA-2026-1794592346- Updated
- 2026-11-14
Show 6 moreShow less
OSVNo score
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
CVE-2014-0107- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0107No score
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
DEBIAN-CVE-2014-0107- Updated
- 2026-11-02
OSVGHSA-rc2w-r4jq-7pfxNo score
Improper Authorization in Apache Xalan-Java
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
GHSA-rc2w-r4jq-7pfx- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVMGASA-2014-0152No score
Updated xalan-j2 packages fix CVE-2014-0107
Updated xalan-j2 packages fix security vulnerability:
Nicolas Gregoire discovered several vulnerabilities in libxalan2-java. Crafted XSLT programs could access system properties or load arbitrary classes, resulting in information disclosure and, potentially, arbitrary code execution (CVE-2014-0107).
- Record
MGASA-2014-0152- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10404-1No score
xalan-j2-2.7.2-5.4 on GA media
These are all security issues fixed in the xalan-j2-2.7.2-5.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10404-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0107No score
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
- Record
UBUNTU-CVE-2014-0107- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
security.gentoo.org/glsa/201604-02
secunia.com/advisories/59291
rhn.redhat.com/errata/RHSA-2015-1888.html
Show 57 moreShow less
debian.org/security/2014/dsa-2886
securityfocus.com/bid/66397
securitytracker.com/id/1034711
exchange.xforce.ibmcloud.com/vulnerabilities/92023
lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
issues.apache.org/jira/browse/XALANJ-2435
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755
www-01.ibm.com/support/docview.wss?uid=swg21676093
ibm.com/support/docview.wss?uid=swg21677967
tenable.com/security/tns-2018-15
ocert.org/advisories/ocert-2014-002.html
svn.apache.org/viewvc?view=revision&revision=1581058
nvd.nist.gov/vuln/detail/CVE-2014-0107
github.com/advisories/GHSA-rc2w-r4jq-7pfx
security-tracker.debian.org/tracker/CVE-2014-0107
advisories.mageia.org/MGASA-2014-0152.html
bugs.mageia.org/show_bug.cgi?id=13104
access.redhat.com/errata/RHSA-2014:0348
bugzilla.redhat.com/show_bug.cgi?id=1080248
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0348.json
cve.org/CVERecord?id=CVE-2014-0107
issues.jboss.org/browse/JBPAPP-10991
ubuntu.com/security/CVE-2014-0107
suse.com/security/cve/CVE-2014-0107