CVE-2010-2076

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...

Design/Logic Flaw

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...

CVE-2010-2076

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...

CVE-2010-2076

CVE-2010-2076 affects Apache CXF: versions 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9 used in various projects (ServiceMix, Camel, jUDDI, Geronimo, etc.). The issue is failure to reject DTDs in SOAP messages, enabling an attacker to read arbitrary files, make HTTP requests t...

Apache Axis2文档类型声明处理多个安全漏洞

BUGTRAQ ID: 40976 CVE ID: CVE-2010-1632 Axis2是一个Web服务的核心支援引擎。 根据SOAP 1.1规范的规定，SOAP消息总不能包含有文档类型声明（DTD）。在Axis2中，是通过StAXSOAPModelBuilder类来实现这个限制的。这个方法存在两个问题： 1 仅适用于SOAP绑定，而支持纯XML消息的HTTP绑定仍允许请求消息中存在DTD。 2 在处理带有DTD的文档时，StAXSOAPModelBuilder仅在从StAX解析器接收到DTD事件后才会报告错误，而这时StAX解析器可能已经处理或部分处理了DTD。...

CVE-2010-1632

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

CVE-2010-1632

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

CVE-2010-1632

CVE-2010-1632 affects Apache Axis2 (Java) and is triggered by improper rejection of DTDs in SOAP messages. The issue allows a remote attacker to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via a crafted DTD, demonstrated by an entity declaration in a...

Debian DSA-1861-1 : libxml - several vulnerabilities

Rauli Kaksonen, Tero Rontti and Jukka Taimisto discovered several vulnerabilities in libxml, a library for parsing and handling XML data files, which can lead to denial of service conditions or possibly arbitrary code execution in the application using the library. The Common Vulnerabilities and...

Debian DSA-1859-1 : libxml2 - several vulnerabilities

Rauli Kaksonen, Tero Rontti and Jukka Taimisto discovered several vulnerabilities in libxml2, a library for parsing and handling XML data files, which can lead to denial of service conditions or possibly arbitrary code execution in the application using the library. The Common Vulnerabilities and...

CentOS 5 : xerces-j2 (CESA-2009:1615)

Updated xerces-j2 packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xerces-j2 packages provide the Apache Xerces2 Java Parser, a high-performance XML parser....

Trillian

Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted DTD file...

xerces security update

CentOS Errata and Security Advisory CESA-2009:1615 Updated xerces-j2 packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xerces-j2 packages provide the Apache...

RHEL 5 : xerces-j2 (RHSA-2009:1615)

Updated xerces-j2 packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xerces-j2 packages provide the Apache Xerces2 Java Parser, a high-performance XML parser....

Moderate: Red Hat Security Advisory: xerces-j2 security update

Updated xerces-j2 packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xerces-j2 packages provide the Apache Xerces2 Java Parser, a high-performance XML parser....

Mandrake Security Advisory MDVSA-2009:223 (xerces-c)

The remote host is missing an update to xerces-c announced via advisory MDVSA-2009:223. OpenVAS Vulnerability Test $Id: mdksa2009223.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:223 xerces-c Authors: Thomas Reinke Copyright: Copyright c 2009 E-Sof...

RedHat Security Advisory RHSA-2009:1206

The remote host is missing updates announced in advisory RHSA-2009:1206. libxml is a library for parsing and manipulating XML files. A Document Type Definition DTD defines the legal syntax and also which elements can be used for certain types of files, such as XML files. A stack overflow flaw was...

Debian Security Advisory DSA 1861-1 (libxml)

The remote host is missing an update to libxml announced via advisory DSA 1861-1. OpenVAS Vulnerability Test $Id: deb18611.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1861-1 libxml Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Debian: Security Advisory (DSA-1859-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-1861-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...