Advisories » MGASA-2014-0556

Updated castor packages fix CVE-2014-3004

Publication date: 31 Dec 2014
Modification date: 31 Dec 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-3004

Description

Updated castor packages fix security vulnerability:

The default configuration for the Xerces SAX Parser in Castor before 1.3.3
allows context-dependent attackers to conduct XML External Entity (XXE)
attacks via a crafted XML document (CVE-2014-3004).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=13554
• https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146246.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3004

SRPMS

4/core

• castor-1.3.3-1.mga4