CVE-2014-0119 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2014-0119 Interim 1 16 2024-06-12T01:51:30Z current 2021-05-30T13:17:31Z 2024-06-12T01:51:30Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2014-0119 Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2014-August/000960.html E-Mail link for SUSE-SU-2014:1015-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 7 SUSE Linux Enterprise Server 11 SP1-TERADATA SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP3 libtcnative-1-0-1.3.3-12.2.1 tomcat-7.0.42-8.el7_0 tomcat-admin-webapps-7.0.42-8.el7_0 tomcat-docs-webapp-7.0.42-8.el7_0 tomcat-el-2.2-api-7.0.42-8.el7_0 tomcat-javadoc-7.0.42-8.el7_0 tomcat-jsp-2.2-api-7.0.42-8.el7_0 tomcat-jsvc-7.0.42-8.el7_0 tomcat-lib-7.0.42-8.el7_0 tomcat-servlet-3.0-api-7.0.42-8.el7_0 tomcat-webapps-7.0.42-8.el7_0 tomcat6-6.0.41-0.43.1 tomcat6-admin-webapps-6.0.41-0.43.1 tomcat6-docs-webapp-6.0.41-0.43.1 tomcat6-javadoc-6.0.41-0.43.1 tomcat6-jsp-2_1-api-6.0.41-0.43.1 tomcat6-lib-6.0.41-0.43.1 tomcat6-servlet-2_5-api-6.0.41-0.43.1 tomcat6-webapps-6.0.41-0.43.1 tomcat-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-admin-webapps-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-docs-webapp-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-el-2.2-api-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-javadoc-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-jsp-2.2-api-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-jsvc-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-lib-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-servlet-3.0-api-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 tomcat-webapps-7.0.42-8.el7_0 as a component of SUSE Liberty Linux 7 libtcnative-1-0-1.3.3-12.2.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-admin-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-docs-webapp-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-javadoc-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-jsp-2_1-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-lib-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-servlet-2_5-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA tomcat6-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA libtcnative-1-0-1.3.3-12.2.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-admin-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-docs-webapp-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-javadoc-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-jsp-2_1-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-lib-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-servlet-2_5-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 tomcat6-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3 libtcnative-1-0-1.3.3-12.2.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-admin-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-docs-webapp-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-javadoc-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-jsp-2_1-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-lib-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-servlet-2_5-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA tomcat6-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-admin-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-docs-webapp-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-javadoc-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-jsp-2_1-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-lib-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-servlet-2_5-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 tomcat6-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server 11 SP4 libtcnative-1-0-1.3.3-12.2.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-admin-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-docs-webapp-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-javadoc-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-jsp-2_1-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-lib-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-servlet-2_5-api-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 tomcat6-webapps-6.0.41-0.43.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application. CVE-2014-0119 SUSE Liberty Linux 7:tomcat-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-admin-webapps-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-docs-webapp-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-el-2.2-api-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-javadoc-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-jsp-2.2-api-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-jsvc-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-lib-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-servlet-3.0-api-7.0.42-8.el7_0 SUSE Liberty Linux 7:tomcat-webapps-7.0.42-8.el7_0 SUSE Linux Enterprise Server 11 SP1-TERADATA:libtcnative-1-0-1.3.3-12.2.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-admin-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-docs-webapp-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-javadoc-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-jsp-2_1-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-lib-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-servlet-2_5-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:tomcat6-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:libtcnative-1-0-1.3.3-12.2.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-admin-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-docs-webapp-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-javadoc-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-jsp-2_1-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-lib-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-servlet-2_5-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3:tomcat6-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libtcnative-1-0-1.3.3-12.2.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-admin-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-docs-webapp-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-javadoc-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-jsp-2_1-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-lib-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-servlet-2_5-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:tomcat6-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-admin-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-docs-webapp-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-javadoc-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-jsp-2_1-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-lib-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-servlet-2_5-api-6.0.41-0.43.1 SUSE Linux Enterprise Server 11 SP4:tomcat6-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libtcnative-1-0-1.3.3-12.2.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-admin-webapps-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-docs-webapp-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-javadoc-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-jsp-2_1-api-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-lib-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-servlet-2_5-api-6.0.41-0.43.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:tomcat6-webapps-6.0.41-0.43.1 low 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N