CVE catalog

CVE-2014-0119

UBUNTU-CVE-2014-0119

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
7.62% · Oct 25, 2026

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntutomcat614.046.0.37-1vulnerable
Ubuntutomcat614.046.0.39-1vulnerable
Ubuntutomcat614.046.0.39-1ubuntu0.1fixed
Ubuntutomcat714.047.0.42-1vulnerable
Ubuntutomcat714.047.0.47-1vulnerable
Ubuntutomcat714.047.0.50-1vulnerable
Ubuntutomcat714.047.0.52-1vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.1vulnerable
Ubuntutomcat714.047.0.52-1ubuntu0.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntutomcat6deb14.046.0.39-1ubuntu0.1Not reportedUBUNTU-CVE-2014-0119Not reported
Ubuntutomcat7deb14.047.0.52-1ubuntu0.3Not reportedUBUNTU-CVE-2014-0119Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]