CVE-2017-7464

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
[UNKNOWN]	JBoss	n/a

References

http://www.securityfocus.com/bid/98450Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7464Issue Tracking, Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/98450Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7464Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-74659.8It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use t CVE-2017-74668.0Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control CVE-2017-74679.8A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could p CVE-2017-74687.5In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed CVE-2017-74709.8It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect au CVE-2017-74719.0Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper acce CVE-2017-74725.5The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of K CVE-2017-74749.8It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass CVE-2017-74755.5Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an applicatio CVE-2017-74769.8Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_r CVE-2017-74777.0Heap-based buffer overflow in drivers/net/macsec.c in the MACsec module in the Linux kernel through 4.10.12 allows attackers to cause a deni CVE-2017-74787.5OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that t