CVE-2013-4002

Published: Jul 23, 2013Modified: Apr 29, 2026

7.1

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability: 8.6 / Impact: 6.9

Source: NVD

Description

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

Affected (90)

Products: Ibm: Java, Sterling B2b Integrator, Host On Demand, Tivoli Application Dependency Discovery Manager, Sterling File Gateway · Oracle: Jdk, Jre, Jrockit · Opensuse: Opensuse · +3 more

Show all products

Ibm

5 products

Java

Sterling B2b Integrator

Host On Demand

Tivoli Application Dependency Discovery Manager

Sterling File Gateway

3 products

1 product

4 products

Linux Enterprise Desktop

Linux Enterprise Java

Linux Enterprise Sdk

Linux Enterprise Server

1 product

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 5.0.0.0
Ibm Java	Version 5.0.11.0
Ibm Java	Version 5.0.11.1
Ibm Java	Version 5.0.11.2
Ibm Java	Version 5.0.12.0
Ibm Java	Version 5.0.12.1
Ibm Java	Version 5.0.12.2
Ibm Java	Version 5.0.12.3
Ibm Java	Version 5.0.12.4
Ibm Java	Version 5.0.12.5
Ibm Java	Version 5.0.13.0
Ibm Java	Version 5.0.14.0
Ibm Java	Version 5.0.15.0
Ibm Java	Version 5.0.16.0
Ibm Java	Version 5.0.16.1
Ibm Java	Version 5.0.16.2

Configuration B

20 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 6.0.0.0
Ibm Java	Version 6.0.1.0
Ibm Java	Version 6.0.10.0
Ibm Java	Version 6.0.10.1
Ibm Java	Version 6.0.11.0
Ibm Java	Version 6.0.12.0
Ibm Java	Version 6.0.13.0
Ibm Java	Version 6.0.13.1
Ibm Java	Version 6.0.13.2
Ibm Java	Version 6.0.2.0
Ibm Java	Version 6.0.3.0
Ibm Java	Version 6.0.4.0
Ibm Java	Version 6.0.5.0
Ibm Java	Version 6.0.6.0
Ibm Java	Version 6.0.7.0
Ibm Java	Version 6.0.8.0
Ibm Java	Version 6.0.8.1
Ibm Java	Version 6.0.9.0
Ibm Java	Version 6.0.9.1
Ibm Java	Version 6.0.9.2

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Ibm Java	Version 7.0.0.0
Ibm Java	Version 7.0.1.0
Ibm Java	Version 7.0.2.0
Ibm Java	Version 7.0.3.0
Ibm Java	Version 7.0.4.0
Ibm Java	Version 7.0.4.1
Ibm Java	Version 7.0.4.2

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Jdk	Version 1.5.0 update51
Oracle Jdk	Version 1.6.0 update60
Oracle Jdk	Version 1.7.0 update40
Oracle Jre	Version 1.5.0 update51
Oracle Jre	Version 1.6.0 update60
Oracle Jre	Version 1.7.0 update40
Oracle Jrockit	From r27.7.0 to r27.7.6
Oracle Jrockit	From r28.0.0 to r28.2.8

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Sterling B2b Integrator	Version 5.2.4

Configuration F

11 vulnerable

Vulnerable Software	Affected Versions
Ibm Host On Demand	Version 11.0.1
Ibm Host On Demand	Version 11.0.2
Ibm Host On Demand	Version 11.0.3
Ibm Host On Demand	Version 11.0.4
Ibm Host On Demand	Version 11.0.5.1
Ibm Host On Demand	Version 11.0.5
Ibm Host On Demand	Version 11.0.6.1
Ibm Host On Demand	Version 11.0.6
Ibm Host On Demand	Version 11.0.7
Ibm Host On Demand	Version 11.0.8
Ibm Host On Demand	Version 11.0

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Tivoli Application Dependency Discovery Manager	Version 7.2.2

Configuration H

4 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Ibm Sterling B2b Integrator	Version 5.1
Ibm Sterling B2b Integrator	Version 5.2
Ibm Sterling File Gateway	Version 2.1
Ibm Sterling File Gateway	Version 2.2

Running on/with	Platform Versions
Hp Hp Ux	All versions
Ibm Aix	All versions
Ibm I	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions
Oracle Solaris	All versions

Configuration I

16 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 12.2
Opensuse Opensuse	Version 12.3
Suse Linux Enterprise Desktop	Version 10 sp4
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Java	Version 10 sp4
Suse Linux Enterprise Java	Version 11 sp2
Suse Linux Enterprise Java	Version 11 sp3
Suse Linux Enterprise Sdk	Version 11 sp2
Suse Linux Enterprise Sdk	Version 11 sp3
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 10 sp4
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 9

Configuration J

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.04
Canonical Ubuntu Linux	Version 13.10

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xerces2 Java	From 2.4.0 to 2.12.0

References (98)

http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html

Source: psirt@us.ibm.com

Broken LinkMailing List

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.html

Source: psirt@us.ibm.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=138674031212883&w=2

Source: psirt@us.ibm.com

Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=138674073720143&w=2

Source: psirt@us.ibm.com

Issue TrackingMailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1059.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1060.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1081.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1440.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1447.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1451.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2013-1505.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2014-1818.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2014-1821.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2014-1822.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2014-1823.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2015-0675.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2015-0720.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2015-0765.html

Source: psirt@us.ibm.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2015-0773.html

Source: psirt@us.ibm.com

Broken Link

http://secunia.com/advisories/56257

Source: psirt@us.ibm.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-201406-32.xml

Source: psirt@us.ibm.com

Third Party Advisory

http://support.apple.com/kb/HT5982

Source: psirt@us.ibm.com

Third Party Advisory

http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patch

Source: psirt@us.ibm.com

PatchVendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IC98015

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21644197

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21653371

Source: psirt@us.ibm.com

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21657539

Source: psirt@us.ibm.com

Vendor Advisory

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.html

Source: psirt@us.ibm.com

Third Party Advisory

http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002

Source: psirt@us.ibm.com

Vendor Advisory

http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013

Source: psirt@us.ibm.com

Vendor Advisory

http://www.ibm.com/support/docview.wss?uid=swg21648172

Source: psirt@us.ibm.com

Broken Link

http://www.securityfocus.com/bid/61310

Source: psirt@us.ibm.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2033-1

Source: psirt@us.ibm.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2089-1

Source: psirt@us.ibm.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2014:0414

Source: psirt@us.ibm.com

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/85260

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

https://issues.apache.org/jira/browse/XERCESJ-1679

Source: psirt@us.ibm.com

Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E

Source: psirt@us.ibm.com

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

Source: psirt@us.ibm.com

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E

Source: psirt@us.ibm.com

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: psirt@us.ibm.com

https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html

Source: psirt@us.ibm.com

Third Party Advisory

http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html