Description
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2014-0883.html
http://rhn.redhat.com/errata/RHSA-2014-0884.html
http://rhn.redhat.com/errata/RHSA-2014-0886.html
http://rhn.redhat.com/errata/RHSA-2014-0885.html
http://www.securitytracker.com/id/1030607
http://secunia.com/advisories/60124
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0091.html
http://rhn.redhat.com/errata/RHSA-2015-0720.html
http://rhn.redhat.com/errata/RHSA-2015-0765.html
http://secunia.com/advisories/60047
https://exchange.xforce.ibmcloud.com/vulnerabilities/94700
http://rhn.redhat.com/errata/RHSA-2015-1888.html
Related Vulnerabilities
CVE-2017-7669 Vulnerability in maven package org.apache.hadoop:hadoop-common
CVE-2023-31454 Vulnerability in maven package org.apache.inlong:manager-service
CVE-2011-2894 Vulnerability in maven package org.springframework:spring-core
CVE-2023-35931 Vulnerability in npm package shescape
CVE-2015-0264 Vulnerability in maven package org.apache.camel:camel-core