RHSA-2011:0858: Moderate: xerces-j2 security update
The xerces-j2 packages provide the Apache Xerces2 Java Parser, ahigh-performance XML parser. A Document Type Definition (DTD) defines thelegal syntax (and also which elements can be used) for certain types offiles, such as XML files.A flaw was found in the way the Apache Xerces2 Java Parser processed theSYSTEM identifier in DTDs. A remote attacker could provide aspecially-crafted XML file, which once parsed by an application using theApache Xerces2 Java Parser, would lead to a denial of service (applicationhang due to excessive CPU use). (CVE-2009-2625)Users should upgrade to these updated packages, which contain a backportedpatch to correct this issue. Applications using the Apache Xerces2 JavaParser must be restarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:0858?
The severity of RHSA-2011:0858 is classified as moderate.
How do I fix RHSA-2011:0858?
To fix RHSA-2011:0858, upgrade the xerces-j2 package to version 2.7.1-12.6.el6_0 or later.
What packages are affected by RHSA-2011:0858?
Affected packages include xerces-j2, xerces-j2-debuginfo, xerces-j2-demo, and several javadoc packages.
When was RHSA-2011:0858 published?
RHSA-2011:0858 was published on October 12, 2011.
What type of vulnerability is addressed by RHSA-2011:0858?
RHSA-2011:0858 addresses an issue in the Apache Xerces2 Java Parser that can lead to potential XML parsing flaws.