ALT-PU-2023-8457-3

Package update xerces-j2 in branch sisyphus

Version2.12.2-alt1_3jpp11

Published2026-02-12

Max severityMEDIUM

Severity:

Closed issues (4)

MEDIUM6.5

Уязвимость библиотеки синтаксического анализа XML Apache Xerces, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-02-11Modified: 2026-02-17

CVSS 3.xMEDIUM 6.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C

References

CVE-2022-23437

MEDIUM6.5

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

Published: 2022-01-24Modified: 2024-11-21

CVSS 2.0HIGH 7.1

CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

GHSA-h65f-jvqw-m9fj

MEDIUM6.5

Infinite Loop in Apache Xerces Java

Published: 2022-01-27Modified: 2023-06-22

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

GHSA-xxx9-3xcr-gjj3

MEDIUM6.5

XML Injection in Xerces Java affects Nokogiri

Published: 2022-04-12

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References