CVE-2013-4002 · threatengine.sh

Home/CVE/XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5

CVE

CVE-2013-4002

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

HIGH · CVSS 7.1 EPSS 0.08028

Schedule remediation

EPSS percentile: top 8% of all CVEs by exploitation likelihood
CVSS base score ≥ 7.0

Sigma rules6 YARA rules0

▤

Affected Products & Versions

7

ibm javaall versions
oracle jdkall versions
oracle jreall versions
oracle jrockit>= r27.7.0 and <= r27.7.6
oracle jrockit>= r28.0.0 and <= r28.2.8
ibm sterling b2b integratorall versions
ibm host on-demandall versions

▤

Affected Packages

1

Language-ecosystem packages (from OSV) tied to this CVE, with the version that fixes it - the dependency-level detail NVD doesn’t carry.

Maven xerces:xercesImpl HIGH fixed in 2.12.0

◈

Sigma Hunt Rules

6

Exact rules name this CVE ID. Product rules name an affected product in their title. Related rules cover techniques used by actors who exploited this CVE. Showing the most relevant matches; the complete related set is on the full drill-down.

producthighSuspicious Java Children Processes

producthighSuspicious Processes Spawned by Java.EXE

producthighSuspicious Shells Spawn by Java Utility Keytool

producthighJava Payload Strings

productmediumJava Running with Remote Debugging

productmediumShell Process Spawned by Java.EXE

See all related Sigma rules for this CVE

▣

Scoring & Timeline

7.1

HIGH · CVSS v2 (legacy) · psirt@us.ibm.com

View on NVD

This CVE predates CVSS v3; the legacy v2 score is shown so triage still has a severity to work with.

v2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Published to NVD23 Jul 2013 · 11:03 AM

⚑

Vendor Advisories

30

suse-csafopenSUSE-SU-2024:10534-1
rhsaRHSA-2015:0235Moderate
rhsaRHSA-2015:0234Moderate
rhsaRHSA-2015:0773Important
rhsaRHSA-2015:0765Moderate
Show all 30 vendor advisoriesrhsaRHSA-2015:0720Moderate
rhsaRHSA-2015:0675Moderate
suse-csafSUSE-SU-2015:0343-1
suse-csafSUSE-SU-2015:1086-4
suse-csafSUSE-SU-2015:1086-2
suse-csafSUSE-SU-2015:0336-1
suse-csafSUSE-SU-2015:0833-1
rhsaRHSA-2014:0414Low
usnUSN-2089-1
usnUSN-2033-1
suse-csafSUSE-SU-2015:0344-1
suse-csafSUSE-SU-2015:1086-3
suse-csafSUSE-SU-2015:0392-1
suse-csafSUSE-SU-2015:1086-1
rhsaRHSA-2013:1451Low
rhsaRHSA-2013:1440Low
rhsaRHSA-2013:1505Low
rhsaRHSA-2013:1447Low
rhsaRHSA-2015:0269Moderate
rhsaRHSA-2013:1081Moderate
rhsaRHSA-2013:1060Moderate
rhsaRHSA-2014:1823Moderate
rhsaRHSA-2014:1822Moderate
rhsaRHSA-2014:1821Moderate
rhsaRHSA-2014:1319Moderate

🔗

References & Sources

48

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.htmlBroken LinkMailing List

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.htmlThird Party Advisory

Show all 48 references

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00003.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00010.htmlThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2013-11/msg00023.htmlThird Party Advisory

http://marc.info/?l=bugtraq&m=138674031212883&w=2Issue TrackingMailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=138674073720143&w=2Issue TrackingMailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-1059.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1060.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1081.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1440.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1447.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1451.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2013-1505.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2014-1818.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2014-1821.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2014-1822.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2014-1823.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2015-0675.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2015-0720.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2015-0765.htmlBroken Link

http://rhn.redhat.com/errata/RHSA-2015-0773.htmlBroken Link

http://secunia.com/advisories/56257Third Party Advisory

http://security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory

http://support.apple.com/kb/HT5982Third Party Advisory

http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=965250&r2=1499506&view=patchPatchVendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IC98015Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21644197Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21653371Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21657539Vendor Advisory

http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS13-025/index.htmlThird Party Advisory

http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm_filenet_content_manager_and_ibm_content_foundation_xml_4j_denial_of_service_attack_cve_2013_4002Vendor Advisory

http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_July_2013Vendor Advisory

http://www.ibm.com/support/docview.wss?uid=swg21648172Broken Link

http://www.securityfocus.com/bid/61310Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2033-1Third Party Advisory

http://www.ubuntu.com/usn/USN-2089-1Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/85260VDB EntryVendor Advisory

https://issues.apache.org/jira/browse/XERCESJ-1679Issue TrackingVendor Advisory

https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E

https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2022.html

https://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlThird Party Advisory

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

NVD CVE.org CISA Vulners Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin