CVE-2013-4002
Summary
| CVE | CVE-2013-4002 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-07-23 11:03:00 UTC |
| Updated | 2023-11-07 02:16:00 UTC |
| Description | XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Xerces2 Java | All | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 10.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 13.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 13.10 | All | All | All |
| Operating System | Hp | Hp-ux | - | All | All | All |
| Operating System | Ibm | Aix | - | All | All | All |
| Application | Ibm | Host On-demand | 11.0 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.1 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.2 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.3 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.4 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.5 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.5.1 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.6 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.6.1 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.7 | All | All | All |
| Application | Ibm | Host On-demand | 11.0.8 | All | All | All |
| Operating System | Ibm | I | - | All | All | All |
| Application | Ibm | Java | 5.0.0.0 | All | All | All |
| Application | Ibm | Java | 5.0.11.0 | All | All | All |
| Application | Ibm | Java | 5.0.11.1 | All | All | All |
| Application | Ibm | Java | 5.0.11.2 | All | All | All |
| Application | Ibm | Java | 5.0.12.0 | All | All | All |
| Application | Ibm | Java | 5.0.12.1 | All | All | All |
| Application | Ibm | Java | 5.0.12.2 | All | All | All |
| Application | Ibm | Java | 5.0.12.3 | All | All | All |
| Application | Ibm | Java | 5.0.12.4 | All | All | All |
| Application | Ibm | Java | 5.0.12.5 | All | All | All |
| Application | Ibm | Java | 5.0.13.0 | All | All | All |
| Application | Ibm | Java | 5.0.14.0 | All | All | All |
| Application | Ibm | Java | 5.0.15.0 | All | All | All |
| Application | Ibm | Java | 5.0.16.0 | All | All | All |
| Application | Ibm | Java | 5.0.16.1 | All | All | All |
| Application | Ibm | Java | 5.0.16.2 | All | All | All |
| Application | Ibm | Java | 6.0.0.0 | All | All | All |
| Application | Ibm | Java | 6.0.1.0 | All | All | All |
| Application | Ibm | Java | 6.0.10.0 | All | All | All |
| Application | Ibm | Java | 6.0.10.1 | All | All | All |
| Application | Ibm | Java | 6.0.11.0 | All | All | All |
| Application | Ibm | Java | 6.0.12.0 | All | All | All |
| Application | Ibm | Java | 6.0.13.0 | All | All | All |
| Application | Ibm | Java | 6.0.13.1 | All | All | All |
| Application | Ibm | Java | 6.0.13.2 | All | All | All |
| Application | Ibm | Java | 6.0.2.0 | All | All | All |
| Application | Ibm | Java | 6.0.3.0 | All | All | All |
| Application | Ibm | Java | 6.0.4.0 | All | All | All |
| Application | Ibm | Java | 6.0.5.0 | All | All | All |
| Application | Ibm | Java | 6.0.6.0 | All | All | All |
| Application | Ibm | Java | 6.0.7.0 | All | All | All |
| Application | Ibm | Java | 6.0.8.0 | All | All | All |
| Application | Ibm | Java | 6.0.8.1 | All | All | All |
| Application | Ibm | Java | 6.0.9.0 | All | All | All |
| Application | Ibm | Java | 6.0.9.1 | All | All | All |
| Application | Ibm | Java | 6.0.9.2 | All | All | All |
| Application | Ibm | Java | 7.0.0.0 | All | All | All |
| Application | Ibm | Java | 7.0.1.0 | All | All | All |
| Application | Ibm | Java | 7.0.2.0 | All | All | All |
| Application | Ibm | Java | 7.0.3.0 | All | All | All |
| Application | Ibm | Java | 7.0.4.0 | All | All | All |
| Application | Ibm | Java | 7.0.4.1 | All | All | All |
| Application | Ibm | Java | 7.0.4.2 | All | All | All |
| Application | Ibm | Java | 5.0.0.0 | All | All | All |
| Application | Ibm | Java | 5.0.11.0 | All | All | All |
| Application | Ibm | Java | 5.0.11.1 | All | All | All |
| Application | Ibm | Java | 5.0.11.2 | All | All | All |
| Application | Ibm | Java | 5.0.12.0 | All | All | All |
| Application | Ibm | Java | 5.0.12.1 | All | All | All |
| Application | Ibm | Java | 5.0.12.2 | All | All | All |
| Application | Ibm | Java | 5.0.12.3 | All | All | All |
| Application | Ibm | Java | 5.0.12.4 | All | All | All |
| Application | Ibm | Java | 5.0.12.5 | All | All | All |
| Application | Ibm | Java | 5.0.13.0 | All | All | All |
| Application | Ibm | Java | 5.0.14.0 | All | All | All |
| Application | Ibm | Java | 5.0.15.0 | All | All | All |
| Application | Ibm | Java | 5.0.16.0 | All | All | All |
| Application | Ibm | Java | 5.0.16.1 | All | All | All |
| Application | Ibm | Java | 5.0.16.2 | All | All | All |
| Application | Ibm | Java | 6.0.0.0 | All | All | All |
| Application | Ibm | Java | 6.0.1.0 | All | All | All |
| Application | Ibm | Java | 6.0.10.0 | All | All | All |
| Application | Ibm | Java | 6.0.10.1 | All | All | All |
| Application | Ibm | Java | 6.0.11.0 | All | All | All |
| Application | Ibm | Java | 6.0.12.0 | All | All | All |
| Application | Ibm | Java | 6.0.13.0 | All | All | All |
| Application | Ibm | Java | 6.0.13.1 | All | All | All |
| Application | Ibm | Java | 6.0.13.2 | All | All | All |
| Application | Ibm | Java | 6.0.2.0 | All | All | All |
| Application | Ibm | Java | 6.0.3.0 | All | All | All |
| Application | Ibm | Java | 6.0.4.0 | All | All | All |
| Application | Ibm | Java | 6.0.5.0 | All | All | All |
| Application | Ibm | Java | 6.0.6.0 | All | All | All |
| Application | Ibm | Java | 6.0.7.0 | All | All | All |
| Application | Ibm | Java | 6.0.8.0 | All | All | All |
| Application | Ibm | Java | 6.0.8.1 | All | All | All |
| Application | Ibm | Java | 6.0.9.0 | All | All | All |
| Application | Ibm | Java | 6.0.9.1 | All | All | All |
| Application | Ibm | Java | 6.0.9.2 | All | All | All |
| Application | Ibm | Java | 7.0.0.0 | All | All | All |
| Application | Ibm | Java | 7.0.1.0 | All | All | All |
| Application | Ibm | Java | 7.0.2.0 | All | All | All |
| Application | Ibm | Java | 7.0.3.0 | All | All | All |
| Application | Ibm | Java | 7.0.4.0 | All | All | All |
| Application | Ibm | Java | 7.0.4.1 | All | All | All |
| Application | Ibm | Java | 7.0.4.2 | All | All | All |
| Application | Ibm | Sterling B2b Integrator | 5.1 | All | All | All |
| Application | Ibm | Sterling B2b Integrator | 5.2 | All | All | All |
| Application | Ibm | Sterling B2b Integrator | 5.2.4 | All | All | All |
| Application | Ibm | Sterling File Gateway | 2.1 | All | All | All |
| Application | Ibm | Sterling File Gateway | 2.2 | All | All | All |
| Application | Ibm | Tivoli Application Dependency Discovery Manager | 7.2.2 | All | All | All |
| Operating System | Linux | Linux Kernel | - | All | All | All |
| Operating System | Microsoft | Windows | - | All | All | All |
| Operating System | Opensuse | Opensuse | 12.2 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.3 | All | All | All |
| Application | Oracle | Jdk | 1.5.0 | update51 | All | All |
| Application | Oracle | Jdk | 1.5.0 | update_51 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update60 | All | All |
| Application | Oracle | Jdk | 1.6.0 | update_60 | All | All |
| Application | Oracle | Jdk | 1.7.0 | update40 | All | All |
| Application | Oracle | Jre | 1.5.0 | update51 | All | All |
| Application | Oracle | Jre | 1.5.0 | update_51 | All | All |
| Application | Oracle | Jre | 1.6.0 | update60 | All | All |
| Application | Oracle | Jre | 1.6.0 | update_60 | All | All |
| Application | Oracle | Jre | 1.7.0 | update40 | All | All |
| Application | Oracle | Jre | 1.7.0 | update_40 | All | All |
| Application | Oracle | Jrockit | All | All | All | All |
| Application | Oracle | Jrockit | All | All | All | All |
| Operating System | Oracle | Solaris | - | All | All | All |
| Operating System | Suse | Linux Enterprise Desktop | 10 | sp4 | All | All |
| Operating System | Suse | Linux Enterprise Desktop | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Java | 10 | sp4 | All | All |
| Operating System | Suse | Linux Enterprise Java | 11 | sp2 | All | All |
| Operating System | Suse | Linux Enterprise Java | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Sdk | 11 | sp2 | All | All |
| Operating System | Suse | Linux Enterprise Sdk | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 10 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 10 | sp4 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp2 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp2 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 9 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [security-announce] SUSE-SU-2013:1263-1: important: Security update for | SUSE | lists.opensuse.org | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| IBM IC98015: DENIAL OF SERVICE ATTACK SECURITY VULNERABILITY - United States | AIXAPAR | www-01.ibm.com | |
| '[security bulletin] HPSBUX02944 rev.1 - HP-UX Running Java7, Remote Unauthorized Access, Disclosure' - MARC | HP | marc.info | |
| '[security bulletin] HPSBUX02943 rev.1 - HP-UX Running Java6, Remote Unauthorized Access, Disclosure' - MARC | HP | marc.info | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| USN-2089-1: OpenJDK 7 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| [security-announce] SUSE-SU-2013:1255-1: important: Security update for | SUSE | lists.opensuse.org | |
| IBM Security Bulletin: Rational Host On-Demand clients affected by vulnerabilities in IBM JRE - United States | CONFIRM | www-01.ibm.com | Vendor Advisory |
| svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanne... | CONFIRM | svn.apache.org | |
| Security Advisory SA56257 - IBM Tivoli Application Dependency Discovery Manager Apache XML Parser Denial of Service Vulnerability - Secunia | SECUNIA | secunia.com | |
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| IBM Java CVE-2013-4002 Denial of Service Vulnerability | BID | www.securityfocus.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [security-announce] SUSE-SU-2013:1257-1: important: Security update for | SUSE | lists.opensuse.org | |
| Multiple Vulnerabilities in Cosminexus: Software Vulnerability Information: Software: Hitachi | CONFIRM | www.hitachi.co.jp | |
| Pony Mail! | lists.apache.org | ||
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| USN-2033-1: OpenJDK 6 vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | |
| [security-announce] SUSE-SU-2013:1666-1: important: Security update for | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [security-announce] SUSE-SU-2013:1293-1: important: Security update for | SUSE | lists.opensuse.org | |
| About the security content of Java for OS X 2013-005 and Mac OS X v10.6 Update 17 | CONFIRM | support.apple.com | |
| IBM Blogs | CONFIRM | www.ibm.com | |
| APPLE-SA-2013-10-15-1 Java for OS X 2013-005 and Mac OS X v10.6 Update 17 | APPLE | lists.apple.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [security-announce] SUSE-SU-2013:1256-1: important: Security update for | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| developerWorks : Technical Topics : Java™ technology : IBM Developer kits : Security alerts | MISC | www.ibm.com | Vendor Advisory |
| Gentoo Linux Documentation -- IcedTea JDK: Multiple vulnerabilities | GENTOO | security.gentoo.org | |
| Oracle Critical Patch Update - October 2013 | CONFIRM | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| openSUSE-SU-2013:1663-1: moderate: update for java-1_7_0-openjdk | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| IBM Security Bulletin: TADDM 7.2.2.0, 7.2.1.5 and 7.2.0.10: Apache Xerces-J XML parser Denial of Service attack. - United States | CONFIRM | www-01.ibm.com | |
| Pony Mail! | lists.apache.org | ||
| [security-announce] SUSE-SU-2013:1305-1: important: Security update for | SUSE | lists.opensuse.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| IBM notice: The page you requested cannot be displayed | CONFIRM | www.ibm.com | |
| IBM Security Bulletin: Vulnerabilities found in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2013-4002, CVE-2013-5409, CVE-2013-5405, CVE-2013-5406, CVE-2013-5407, CVE-2013-5411, CVE-2013-5413) - United States | CONFIRM | www-01.ibm.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| [XERCESJ-1679] xercesImpl: Security threat CVE-2013-4002 - ASF JIRA | CONFIRM | issues.apache.org | |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.