CVE-2013-4002

Description

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

7.1

CVSS

Severity: High

CVSS 2.0 •

EPSS 1.42% Top 25%

Vendor Advisory ibm.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory opensuse.org Vendor Advisory apache.org Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibm.com Vendor Advisory ibmcloud.com Vendor Advisory apache.org

Affected: n/a n/a

References

Link	Tags
http://www-01.ibm.com/support/docview.wss?uid=swg1IC98015	vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1060.html	vendor advisory broken link
https://access.redhat.com/errata/RHSA-2014:0414	third party advisory vendor advisory
http://security.gentoo.org/glsa/glsa-201406-32.xml	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1447.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2015-0765.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2013-1440.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2015-0675.html	vendor advisory broken link
http://www.securityfocus.com/bid/61310	vdb entry third party advisory
http://rhn.redhat.com/errata/RHSA-2015-0773.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2015-0720.html	vendor advisory broken link
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html	third party advisory vendor advisory
http://www.ubuntu.com/usn/USN-2033-1	third party advisory vendor advisory
http://www.ubuntu.com/usn/USN-2089-1	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html	third party advisory vendor advisory
http://marc.info/?l=bugtraq&m=138674073720143&w=2	issue tracking mailing list third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1505.html	vendor advisory broken link
http://marc.info/?l=bugtraq&m=138674031212883&w=2	issue tracking mailing list third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2014-1822.html	vendor advisory broken link
http://secunia.com/advisories/56257	third party advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1059.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2014-1823.html	vendor advisory broken link
http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.html	third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.html	third party advisory vendor advisory
http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html	mailing list broken link vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1081.html	vendor advisory broken link
https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E	mailing list
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html	third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2013-1451.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2014-1818.html	vendor advisory broken link
http://rhn.redhat.com/errata/RHSA-2014-1821.html	vendor advisory broken link
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html	third party advisory vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85260	vdb entry vendor advisory
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E	mailing list
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E	mailing list
https://www.oracle.com/security-alerts/cpuapr2022.html
http://www.ibm.com/support/docview.wss?uid=swg21648172	broken link
http://www-01.ibm.com/support/docview.wss?uid=swg21657539	vendor advisory
https://issues.apache.org/jira/browse/XERCESJ-1679	issue tracking vendor advisory
http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch	patch vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21644197	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21653371	vendor advisory
http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013	vendor advisory
http://support.apple.com/kb/HT5982	third party advisory
https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html	third party advisory
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002	vendor advisory
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html	third party advisory

Frequently Asked Questions

What is the severity of CVE-2013-4002?: CVE-2013-4002 has been scored as a high severity vulnerability.
How to fix CVE-2013-4002?: To fix CVE-2013-4002, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2013-4002 being actively exploited in the wild?: It is possible that CVE-2013-4002 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.