Fixed in Apache Tomcat 7.0.54

Low: Information Disclosure CVE-2014-0119

In limited circumstances it was possible for a malicious web application to replace the XML parsers used by Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors (TLDs) and tag plugin configuration files. The injected XML parser(s) could then bypass the limits imposed on XML external entities and/or have visibility of the XML files processed for other web applications deployed on the same Tomcat instance.

This was fixed in revisions 1588199, 1589997, 1590028 and 1590036.

This issue was identified by the Tomcat security team on 12 April 2014 and made public on 27 May 2014.

Affects: 7.0.0-7.0.53