[SECURITY] [DSA 2886-1] libxalan2-java security update

2014-03-2620:21:08

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

77.1%

JSON

Debian Security Advisory DSA-2886-1 [email protected]
http://www.debian.org/security/ Florian Weimer
March 26, 2014 http://www.debian.org/security/faq

Package : libxalan2-java
CVE ID : CVE-2014-0107
Debian Bug : 742577

Nicolas Gregoire discovered several vulnerabilities in libxalan2-java,
a Java library for XSLT processing. Crafted XSLT programs could
access system properties or load arbitrary classes, resulting in
information disclosure and, potentially, arbitrary code execution.

For the oldstable distribution (squeeze), this problem has been fixed in
version 2.7.1-5+deb6u1.

For the stable distribution (wheezy), this problem has been fixed in
version 2.7.1-7+deb7u1.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.1-9.

We recommend that you upgrade your libxalan2-java packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6s390libxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_s390.deb
Debian6armellibxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_armel.deb
Debian6mipslibxalan2-java-gcj< 2.7.1-5+deb6u1libxalan2-java-gcj_2.7.1-5+deb6u1_mips.deb
Debian6amd64libxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_amd64.deb
Debian6i386libxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_i386.deb
Debian6alllibxalan2-java< 2.7.1-5+deb6u1libxalan2-java_2.7.1-5+deb6u1_all.deb
Debian6powerpclibxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_powerpc.deb
Debian7alllibxalan2-java-doc< 2.7.1-7+deb7u1libxalan2-java-doc_2.7.1-7+deb7u1_all.deb
Debian6sparclibxsltc-java-gcj< 2.7.1-5+deb6u1libxsltc-java-gcj_2.7.1-5+deb6u1_sparc.deb
Debian6alllibxsltc-java< 2.7.1-5+deb6u1libxsltc-java_2.7.1-5+deb6u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	s390	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_s390.deb
Debian	6	armel	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_armel.deb
Debian	6	mips	libxalan2-java-gcj	< 2.7.1-5+deb6u1	libxalan2-java-gcj_2.7.1-5+deb6u1_mips.deb
Debian	6	amd64	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_amd64.deb
Debian	6	i386	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_i386.deb
Debian	6	all	libxalan2-java	< 2.7.1-5+deb6u1	libxalan2-java_2.7.1-5+deb6u1_all.deb
Debian	6	powerpc	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_powerpc.deb
Debian	7	all	libxalan2-java-doc	< 2.7.1-7+deb7u1	libxalan2-java-doc_2.7.1-7+deb7u1_all.deb
Debian	6	sparc	libxsltc-java-gcj	< 2.7.1-5+deb6u1	libxsltc-java-gcj_2.7.1-5+deb6u1_sparc.deb
Debian	6	all	libxsltc-java	< 2.7.1-5+deb6u1	libxsltc-java_2.7.1-5+deb6u1_all.deb