Apache XERCES2 Java vulnerabilities

3 CVEs affecting Apache XERCES2 Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-0881, published 2017-10-30.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2009-2625, published 2009-08-06. Medium severity, CVSS 5.0. EPSS: 30.4% chance of exploitation in the next 30 days. XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote…
• CVE-2013-4002, published 2013-07-23. High severity, CVSS 7.1. EPSS: 24.7% chance of exploitation in the next 30 days. XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7…
• CVE-2012-0881, published 2017-10-30. High severity, CVSS 7.5. EPSS: 17.5% chance of exploitation in the next 30 days. Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.