(RHSA-2014:1319) Moderate: xerces-j2 security update

2014-09-2900:00:00

access.redhat.com

EPSS

0.019

Percentile

88.5%

JSON

Apache Xerces for Java (Xerces-J) is a high performance, standards
compliant, validating XML parser written in Java. The xerces-j2 packages
provide Xerces-J version 2.

A resource consumption issue was found in the way Xerces-J handled XML
declarations. A remote attacker could use an XML document with a specially
crafted declaration using a long pseudo-attribute name that, when parsed by
an application using Xerces-J, would cause that application to use an
excessive amount of CPU. (CVE-2013-4002)

All xerces-j2 users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. Applications using the
Xerces-J must be restarted for this update to take effect.

OSVersionArchitecturePackageVersionFilename
RedHat6i686xerces-j2-javadoc-apis< 2.7.1-12.7.el6_5xerces-j2-javadoc-apis-2.7.1-12.7.el6_5.i686.rpm
RedHat6s390xxerces-j2-debuginfo< 2.7.1-12.7.el6_5xerces-j2-debuginfo-2.7.1-12.7.el6_5.s390x.rpm
RedHat6i686xerces-j2-demo< 2.7.1-12.7.el6_5xerces-j2-demo-2.7.1-12.7.el6_5.i686.rpm
RedHat6i686xerces-j2-javadoc-impl< 2.7.1-12.7.el6_5xerces-j2-javadoc-impl-2.7.1-12.7.el6_5.i686.rpm
RedHat6ppc64xerces-j2-demo< 2.7.1-12.7.el6_5xerces-j2-demo-2.7.1-12.7.el6_5.ppc64.rpm
RedHat6s390xxerces-j2-javadoc-apis< 2.7.1-12.7.el6_5xerces-j2-javadoc-apis-2.7.1-12.7.el6_5.s390x.rpm
RedHat6x86_64xerces-j2-scripts< 2.7.1-12.7.el6_5xerces-j2-scripts-2.7.1-12.7.el6_5.x86_64.rpm
RedHat6ppc64xerces-j2-debuginfo< 2.7.1-12.7.el6_5xerces-j2-debuginfo-2.7.1-12.7.el6_5.ppc64.rpm
RedHat7noarchxerces-j2< 2.11.0-17.el7_0xerces-j2-2.11.0-17.el7_0.noarch.rpm
RedHat6s390xxerces-j2< 2.7.1-12.7.el6_5xerces-j2-2.7.1-12.7.el6_5.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	6	i686	xerces-j2-javadoc-apis	< 2.7.1-12.7.el6_5	xerces-j2-javadoc-apis-2.7.1-12.7.el6_5.i686.rpm
RedHat	6	s390x	xerces-j2-debuginfo	< 2.7.1-12.7.el6_5	xerces-j2-debuginfo-2.7.1-12.7.el6_5.s390x.rpm
RedHat	6	i686	xerces-j2-demo	< 2.7.1-12.7.el6_5	xerces-j2-demo-2.7.1-12.7.el6_5.i686.rpm
RedHat	6	i686	xerces-j2-javadoc-impl	< 2.7.1-12.7.el6_5	xerces-j2-javadoc-impl-2.7.1-12.7.el6_5.i686.rpm
RedHat	6	ppc64	xerces-j2-demo	< 2.7.1-12.7.el6_5	xerces-j2-demo-2.7.1-12.7.el6_5.ppc64.rpm
RedHat	6	s390x	xerces-j2-javadoc-apis	< 2.7.1-12.7.el6_5	xerces-j2-javadoc-apis-2.7.1-12.7.el6_5.s390x.rpm
RedHat	6	x86_64	xerces-j2-scripts	< 2.7.1-12.7.el6_5	xerces-j2-scripts-2.7.1-12.7.el6_5.x86_64.rpm
RedHat	6	ppc64	xerces-j2-debuginfo	< 2.7.1-12.7.el6_5	xerces-j2-debuginfo-2.7.1-12.7.el6_5.ppc64.rpm
RedHat	7	noarch	xerces-j2	< 2.11.0-17.el7_0	xerces-j2-2.11.0-17.el7_0.noarch.rpm
RedHat	6	s390x	xerces-j2	< 2.7.1-12.7.el6_5	xerces-j2-2.7.1-12.7.el6_5.s390x.rpm