Unscored severity · published Jul 23, 2013
CVE-2013-4002
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1…
–
CVSS
24.7%
EPSS
No
On KEV
Description
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Exploitation
Is it being used?
Exploit prediction (EPSS)24.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
Host On-demand · Ibm
11.0; 11.0.1; 11.0.2; 11.0.3; 11.0.4; 11.0.5; +5 more · source: NVD
JA
Java · Ibm
5.0.0.0; 5.0.11.0; 5.0.11.1; 5.0.11.2; 5.0.12.0; 5.0.12.1; +34 more · source: NVD
JD
Jdk · Oracle
1.5.0; 1.6.0; 1.7.0 · source: NVD
JR
Jre · Oracle
1.5.0; 1.6.0; 1.7.0 · source: NVD
JR
Jrockit · Oracle
r27.7.0 through r27.7.6; r28.0.0 through r28.2.8 · source: NVD
LE
Linux Enterprise Desktop · Suse
10; 11 · source: NVD
LE
Linux Enterprise Java · Suse
10; 11; 11 · source: NVD
LE
Linux Enterprise Sdk · Suse
11; 11 · source: NVD
LE
Linux Enterprise Server · Suse
9; 10; 10; 11; 11; 11; +1 more · source: NVD
OP
Opensuse · Opensuse
12.2; 12.3 · source: NVD
SB
Sterling B2b Integrator · Ibm
5.2.4; 5.1; 5.2 · source: NVD
SF
Sterling File Gateway · Ibm
2.1; 2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4002
Broken Link
http://lists.apple.com/archives/security-announce/2013/Oct/msg00001.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00026.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00027.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00028.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00029.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00000.html
More from Xerces2 Java
7.5
CVE-2012-0881
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table…
–
CVE-2009-2625
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other…