Каталог CVE

CVE-2018-1000632

dom4j affected and fixed versions

[Каталог CVE]

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Критичність
Medium · CVSS 6.1CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
6.57% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiedom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debiantrixiedom4j2.1.4-1Fixed[CVE-2018-1000632]
Debiansiddom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debiansiddom4j2.1.4-1Fixed[CVE-2018-1000632]
Debianforkydom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debianforkydom4j2.1.4-1Fixed[CVE-2018-1000632]
Debianbookwormdom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debianbookwormdom4j2.1.3-2Fixed[CVE-2018-1000632]

Showing 8 fix observations. All 21 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormdom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debianbookwormdom4j2.1.3-2Fixed[CVE-2018-1000632]
Debianforkydom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debianforkydom4j2.1.4-1Fixed[CVE-2018-1000632]
Debiansiddom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debiansiddom4j2.1.4-1Fixed[CVE-2018-1000632]
Debiantrixiedom4j2.1.1-1FixedDistribution-reported fixed boundary[CVE-2018-1000632]
Debiantrixiedom4j2.1.4-1Fixed[CVE-2018-1000632]
Opensusetumbleweeddom4j1.6.1-33.6UnknownSource applicability is not established[OPENSUSE-SU-2024:10724-1]
Suselinux enterprise software development kit 11 sp4dom4j1.6.1-8.3.8.1UnknownSource applicability is not established[SUSE-SU-2018:3424-1]
Susemanager server 3.0dom4j1.6.1-27.4.1UnknownSource applicability is not established[SUSE-SU-2018:2861-1]
Susemanager server 3.1dom4j1.6.1-3.3.2UnknownSource applicability is not established[SUSE-SU-2018:2863-1]
Susemanager server 3.2dom4j1.6.1-27.4.1UnknownSource applicability is not established[SUSE-SU-2018:2861-1]
Susepackage hub 15dom4j1.6.1-bp150.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2018:4045-1]
Ubuntu14.04dom4j1.6.1+dfsg.3-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000632]
Ubuntu16.04dom4j1.6.1+dfsg.3-2ubuntu1UnknownSource applicability is not established[USN-4619-1][UBUNTU-CVE-2018-1000632]
Ubuntu16.04dom4j1.6.1+dfsg.3-2ubuntu1.1UnknownSource applicability is not established[USN-4619-1][UBUNTU-CVE-2018-1000632]
Ubuntu16.04dom4j1.6.1+dfsg.3-2ubuntu1.2UnknownSource applicability is not established[USN-4619-1][UBUNTU-CVE-2018-1000632]
Ubuntu18.04dom4j1.6.1+dfsg.3-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000632]
Ubuntu18.04dom4j2.1.0-1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000632]
Ubuntu18.04dom4j2.1.0-2UnknownSource applicability is not established[UBUNTU-CVE-2018-1000632]
Original provider fields
{
  "package_releases": [
    {
      "name": "dom4j",
      "status": "fixed",
      "release": "sid",
      "version": "2.1.4-1"
    },
    {
      "name": "dom4j",
      "status": "fixed",
      "release": "forky",
      "version": "2.1.4-1"
    },
    {
      "name": "dom4j",
      "status": "fixed",
      "release": "trixie",
      "version": "2.1.4-1"
    },
    {
      "name": "dom4j",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.1.3-2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "dom4j",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "2.1.1-1"
    },
    {
      "bug": null,
      "name": "dom4j",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "2.1.1-1"
    },
    {
      "bug": null,
      "name": "dom4j",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "2.1.1-1"
    },
    {
      "bug": null,
      "name": "dom4j",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "2.1.1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "dom4j",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1+dfsg.3-2ubuntu1.2"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.6.1+dfsg.3-2ubuntu1",
        "1.6.1+dfsg.3-2ubuntu1.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4619-1",
      "fixed_version": "1.6.1+dfsg.3-2ubuntu1.2",
      "provider_source": "pypi",
      "provider_record_id": "USN-4619-1",
      "provider_updated_at": "2026-04-27T15:46:32.963325Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-27.4.1"
            }
          ]
        }
      ],
      "release": "manager server 3.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:2861-1",
      "fixed_version": "1.6.1-27.4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:2861-1",
      "provider_updated_at": "2026-02-04T04:22:54.146108Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-27.4.1"
            }
          ]
        }
      ],
      "release": "manager server 3.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:2861-1",
      "fixed_version": "1.6.1-27.4.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:2861-1",
      "provider_updated_at": "2026-02-04T04:22:54.146108Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-3.3.2"
            }
          ]
        }
      ],
      "release": "manager server 3.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:2863-1",
      "fixed_version": "1.6.1-3.3.2",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:2863-1",
      "provider_updated_at": "2026-02-04T04:05:56.139213Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-bp150.2.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2018:4045-1",
      "fixed_version": "1.6.1-bp150.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2018:4045-1",
      "provider_updated_at": "2026-02-04T03:56:47.168305Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "1.6.1+dfsg.3-2ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000632",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2018-1000632",
      "provider_updated_at": "2026-02-04T03:39:03.787397Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1+dfsg.3-2ubuntu1.2"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.6.1+dfsg.3-2ubuntu1",
        "1.6.1+dfsg.3-2ubuntu1.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000632",
      "fixed_version": "1.6.1+dfsg.3-2ubuntu1.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2018-1000632",
      "provider_updated_at": "2026-02-04T03:39:03.787397Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.6.1+dfsg.3-2ubuntu1",
        "2.1.0-1",
        "2.1.0-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000632",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2018-1000632",
      "provider_updated_at": "2026-02-04T03:39:03.787397Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-33.6"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:10724-1",
      "fixed_version": "1.6.1-33.6",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:10724-1",
      "provider_updated_at": "2026-02-04T03:24:45.738108Z",
      "applicability_unknown": true
    },
    {
      "name": "dom4j",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.1-8.3.8.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 11 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:3424-1",
      "fixed_version": "1.6.1-8.3.8.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:3424-1",
      "provider_updated_at": "2026-02-04T02:43:05.239801Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

  • [libdom4j-java]Невідомо

    Пакет джерела: [dom4j]

    Подробиці (2)

    • 2.1.3-2 · all · bookworm

      Виправлена · Виправлена: 2.1.1-1

      dsa · dom4j · debian · bookworm; dsa · dom4j · debian · 12

    • 2.1.3-2 · all · bookworm

      Виправлена · Виправлена: 2.1.1-1

      dsa · dom4j · debian · bookworm; dsa · dom4j · debian · 12

[Debian 13 (Trixie)]

  • [libdom4j-java]Невідомо

    Пакет джерела: [dom4j]

    Подробиці (2)

    • 2.1.4-1 · all · trixie

      Виправлена · Виправлена: 2.1.1-1

      dsa · dom4j · debian · 13

    • 2.1.4-1 · all · trixie

      Виправлена · Виправлена: 2.1.1-1

      dsa · dom4j · debian · 13

[openSUSE Tumbleweed]

  • [dom4j]Невідомо

    Пакет джерела: [dom4j]

    Подробиці (1)

    • 2.1.5-1.4 · noarch · tumbleweed

      Виправлена · Виправлена: 1.6.1-33.6

      dsa · dom4j · opensuse · tumbleweed

  • [dom4j-demo]Невідомо

    Пакет джерела: [dom4j]

    Подробиці (1)

    • 2.1.5-1.4 · noarch · tumbleweed

      Невідомо · Виправлена: 1.6.1-33.6

      Version impact unknown

      dsa · dom4j · opensuse · tumbleweed

  • [dom4j-javadoc]Невідомо

    Пакет джерела: [dom4j]

    Подробиці (1)

    • 2.1.5-1.4 · noarch · tumbleweed

      Невідомо · Виправлена: 1.6.1-33.6

      Version impact unknown

      dsa · dom4j · opensuse · tumbleweed

Спостережено:

Посилання

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]