907 matches found
SUSE-SU-2017:2749-1 Security update for xerces-j2
xerces-j2 was updated to fix several issues. This security issue was fixed: - bsc814241: Prevent possible DoS through very long attribute names This non-security issue was fixed: - Prevent StackOverflowError when applying a pattern restriction on long strings while trying to validate an XML file...
Denial Of Service (DoS)
Xerces2-j aka Apache Xerces-J parser is vulnerable to denial of service DoS. The attack can be triggered when malicious XML data is passed to Apache Xerces-J parser and processed by the JRE...
CVE-2017-12621
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
CVE-2017-12621
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
CVE-2017-12621
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
Xxe
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
UBUNTU-CVE-2017-12621
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
CVE-2017-12621
During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...
CVE-2017-12621
The CVE-2017-12621 issue is an XXE vulnerability in Apache Commons Jelly when parsing Jelly XML and a SYSTEM entity URL is used in the document, causing the parser to connect to that URL during instantiation. Affected version: Apache Commons Jelly before 1.0.1. Impact per sources indicates potent...
Oracle Java and the Apache Xerces PDF/Docx Server DDOS vulnerability-vulnerability warning-the black bar safety net
One, flaws summary Oracle Java JDK/JRE（1.8.0.131 and earlier versions of the package and the Apache Xerces（2.11.0 version, there are two flaws, two flaws were: The Oracle JDK/JRE and-rebuff-do（DoS）flaws java. net. URLConnection not apply setConnectTimeout when and-rebuff-do. Oracle has received t...
Oracle Java JDKJRE 1.8.0.131 Apache Xerces 2.11.0 - PDFDocx Server Side Denial of Service
Oracle Java JDKJRE 1.8.0.131 Apache Xerces 2.11.0 - PDFDocx Server Side Denial of Service Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Oracle Java JDK/JRE 1.8.0.131 and previous versions packages and Apache Xerces 2.11.0 The vulnerabilities are: Oracle...
Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service
Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in Oracle Java JDK/JRE 1.8.0.131 and previous versions packages and Apache Xerces 2.11.0 The vulnerabilities are: Oracle JDK/JRE Concurrency-Related Denial of Service java.net.URLConnection with no...
Apache Xerces-C++ Denial of Service Vulnerability
Apache Xerces is an XML syntax parser from the Apache Software Foundation.Apache Xerces-C++ is the language version. A security vulnerability exists in Apache Xerces-C++. A remote attacker can exploit this vulnerability by sending a specially crafted message to the XML service to cause a denial o...
Code injection
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
DEBIAN-CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
UBUNTU-CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service CPU consumption via a crafted message sent to an XML service that causes hash table collisions...
CVE-2012-0880
CVE-2012-0880 affects Apache Xerces-C++, allowing a remote attacker to cause a denial of service (CPU consumption) by sending a crafted XML message that triggers hash table collisions. Based on connected documents, impact is high (CVSS v3 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). remediatio...