XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Java | — | Upgrade to Apple Java version 1.6.0.65 | Oct 18, 2013 | Jul 23, 2013 |
| Centos_linux | — | Upgrade xerces-j2-demoUpgrade java-1.6.0-openjdk-srcUpgrade xerces-j2-javadoc-xniUpgrade xerces-j2-javadoc-apisUpgrade java-1.7.0-openjdkUpgrade java-1.6.0-openjdk-develUpgrade java-1.7.0-openjdk-demoUpgrade xerces-j2-javadocUpgrade java-1.6.0-openjdk-demoUpgrade java-1.7.0-openjdk-javadocUpgrade java-1.6.0-openjdkUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.7.0-openjdk-develUpgrade xerces-j2-javadoc-implUpgrade xerces-j2-javadoc-otherUpgrade java-1.7.0-openjdk-srcUpgrade xerces-j2Upgrade xerces-j2-scripts | Dec 1, 2016 | Jul 23, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 11, 2015 |
| Gentoo Linux | — | Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Jul 23, 2013 |
| Hpux | — | Update Jre70.JRE70-IPF64 to the latest versionUpdate Jdk70.JDK70-IPF64 to the latest versionUpdate Jdk70.JDK70-DEMO to the latest versionUpdate Jre70.JRE70-IPF64-HS to the latest versionUpdate Jre70.JRE70-IPF32-HS to the latest versionUpdate Jre70.JRE70-COM to the latest versionUpdate Jre70.JRE70-IPF32 to the latest versionUpdate Jdk70.JDK70-COM to the latest versionUpdate Jdk70.JDK70-IPF32 to the latest version | Aug 11, 2017 | Jul 23, 2013 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Nov 7, 2013 | Jul 23, 2013 |
| Oracle_linux | — | Upgrade java-1.7.0-openjdk-srcUpgrade java-1.6.0-openjdk-demoUpgrade xerces-j2-javadoc-apisUpgrade java-1.7.0-openjdkUpgrade xerces-j2-javadoc-xniUpgrade java-1.6.0-openjdk-srcUpgrade xerces-j2-javadocUpgrade java-1.7.0-openjdk-demoUpgrade java-1.6.0-openjdk-develUpgrade java-1.7.0-openjdk-develUpgrade xerces-j2-demoUpgrade java-1.6.0-openjdkUpgrade java-1.7.0-openjdk-javadocUpgrade xerces-j2Upgrade xerces-j2-scriptsUpgrade xerces-j2-javadoc-otherUpgrade xerces-j2-javadoc-implUpgrade java-1.6.0-openjdk-javadoc | Oct 16, 2024 | Jul 23, 2013 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 15, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 15, 2013 |
| Suse | — | Upgrade java-1_5_0-ibm-devel-32bitUpgrade sle-sdk-releaseUpgrade java-1_6_0-ibm-32bitUpgrade java-1_5_0-ibm-32bitUpgrade java-1_5_0-ibm-64bitUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibm-64bitUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_7_0-ibm-develUpgrade java-1_7_0-openjdk-javadocUpgrade java-1_5_0-ibm-pluginUpgrade java-1_6_0-ibmUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_5_0-ibm-demoUpgrade java-1_6_0-openjdk-develUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_7_0-openjdk-demoUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_5_0-ibm-fontsUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_7_0-openjdkUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_6_0-ibm-pluginUpgrade java-1_7_0-openjdk-srcUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibm-alsaUpgrade java-1_7_0-openjdk-develUpgrade java-1_5_0-ibm-develUpgrade java-1_5_0-ibm-alsaUpgrade java-1_6_0-openjdk-demoUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-ibmUpgrade java-1_5_0-ibmUpgrade java-1_5_0-ibm-src | Feb 17, 2015 | Jul 23, 2013 |
| Ubuntu | — | Upgrade icedtea-6-jre-jamvmUpgrade openjdk-7-jre-zeroUpgrade icedtea-6-jre-cacaoUpgrade openjdk-6-jre-headlessUpgrade openjdk-6-jre-libUpgrade openjdk-7-jre-libUpgrade openjdk-6-jre-zeroUpgrade icedtea-7-jre-cacaoUpgrade openjdk-7-jreUpgrade icedtea-7-jre-jamvmUpgrade openjdk-7-jre-headlessUpgrade openjdk-6-jre | Nov 8, 2024 | Jul 23, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub