XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Java | — | Upgrade to Apple Java version 1.6.0.65 | Oct 18, 2013 | Jul 23, 2013 |
| Centos_linux | — | Upgrade java-1.6.0-openjdkUpgrade xerces-j2-javadoc-apisUpgrade java-1.7.0-openjdk-demoUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk-demoUpgrade java-1.7.0-openjdk-javadocUpgrade xerces-j2-javadocUpgrade xerces-j2-javadoc-xniUpgrade xerces-j2-demoUpgrade java-1.7.0-openjdkUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-javadocUpgrade xerces-j2-javadoc-implUpgrade java-1.7.0-openjdk-develUpgrade xerces-j2-scriptsUpgrade xerces-j2-javadoc-otherUpgrade java-1.7.0-openjdk-srcUpgrade xerces-j2 | Dec 1, 2016 | Jul 23, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 11, 2015 |
| Gentoo Linux | — | Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Jul 23, 2013 |
| Hpux | — | Update Jre70.JRE70-IPF64 to the latest versionUpdate Jdk70.JDK70-IPF64 to the latest versionUpdate Jre70.JRE70-IPF32-HS to the latest versionUpdate Jre70.JRE70-IPF32 to the latest versionUpdate Jdk70.JDK70-COM to the latest versionUpdate Jre70.JRE70-IPF64-HS to the latest versionUpdate Jre70.JRE70-COM to the latest versionUpdate Jdk70.JDK70-IPF32 to the latest versionUpdate Jdk70.JDK70-DEMO to the latest version | Aug 11, 2017 | Jul 23, 2013 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Nov 7, 2013 | Jul 23, 2013 |
| Oracle_linux | — | Upgrade java-1.6.0-openjdk-javadocUpgrade xerces-j2-javadoc-otherUpgrade xerces-j2-scriptsUpgrade xerces-j2-javadoc-implUpgrade java-1.6.0-openjdk-demoUpgrade java-1.7.0-openjdk-demoUpgrade java-1.7.0-openjdkUpgrade java-1.7.0-openjdk-javadocUpgrade xerces-j2-javadocUpgrade java-1.6.0-openjdkUpgrade xerces-j2-javadoc-xniUpgrade java-1.6.0-openjdk-srcUpgrade java-1.7.0-openjdk-develUpgrade java-1.6.0-openjdk-develUpgrade xerces-j2-demoUpgrade xerces-j2-javadoc-apisUpgrade xerces-j2Upgrade java-1.7.0-openjdk-src | Oct 16, 2024 | Jul 23, 2013 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Oct 15, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 15, 2013 |
| Suse | — | Upgrade java-1_7_0-openjdk-develUpgrade java-1_6_0-ibm-pluginUpgrade java-1_6_0-ibm-devel-32bitUpgrade java-1_5_0-ibm-fontsUpgrade java-1_5_0-ibm-develUpgrade java-1_7_0-openjdk-srcUpgrade java-1_7_0-openjdk-demoUpgrade java-1_6_0-openjdk-demoUpgrade java-1_5_0-ibmUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_5_0-ibm-alsaUpgrade java-1_7_0-openjdkUpgrade java-1_5_0-ibm-demoUpgrade java-1_5_0-ibm-srcUpgrade java-1_7_0-ibmUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-fontsUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_6_0-openjdk-develUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_0-openjdk-javadocUpgrade java-1_5_0-ibm-devel-32bitUpgrade java-1_6_0-ibm-32bitUpgrade java-1_5_0-ibm-64bitUpgrade java-1_6_0-ibm-plugin-32bitUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_5_0-ibm-pluginUpgrade java-1_6_0-ibm-64bitUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_5_0-ibm-32bitUpgrade java-1_7_0-ibm-develUpgrade sle-sdk-releaseUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibm | Feb 17, 2015 | Jul 23, 2013 |
| Ubuntu | — | Upgrade icedtea-6-jre-cacaoUpgrade openjdk-7-jre-zeroUpgrade icedtea-6-jre-jamvmUpgrade openjdk-7-jre-libUpgrade icedtea-7-jre-jamvmUpgrade openjdk-6-jre-headlessUpgrade openjdk-6-jre-libUpgrade openjdk-6-jreUpgrade openjdk-6-jre-zeroUpgrade icedtea-7-jre-cacaoUpgrade openjdk-7-jreUpgrade openjdk-7-jre-headless | Nov 8, 2024 | Jul 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub