{"id":"UBUNTU-CVE-2014-3004","details":"The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.","modified":"2026-05-20T16:03:08.064666234Z","published":"2014-06-11T14:55:00Z","upstream":["CVE-2014-3004"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2014-3004"},{"type":"REPORT","url":"http://seclists.org/fulldisclosure/2014/May/142"},{"type":"REPORT","url":"http://packetstormsecurity.com/files/126854/Castor-Library-XXE-Disclosure.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2014-3004"}],"affected":[{"package":{"name":"castor","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-3"],"ecosystem_specific":{"binaries":[{"binary_name":"libcastor-anttasks-java","binary_version":"1.3.2-3"},{"binary_version":"1.3.2-3","binary_name":"libcastor-codegen-java"},{"binary_name":"libcastor-core-java","binary_version":"1.3.2-3"},{"binary_name":"libcastor-ddlgen-java","binary_version":"1.3.2-3"},{"binary_name":"libcastor-jdo-java","binary_version":"1.3.2-3"},{"binary_version":"1.3.2-3","binary_name":"libcastor-xml-java"},{"binary_version":"1.3.2-3","binary_name":"libcastor-xml-schema-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-4","1.3.2-5","1.3.2-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libcastor-anttasks-java","binary_version":"1.3.2-6"},{"binary_version":"1.3.2-6","binary_name":"libcastor-codegen-java"},{"binary_version":"1.3.2-6","binary_name":"libcastor-core-java"},{"binary_version":"1.3.2-6","binary_name":"libcastor-ddlgen-java"},{"binary_name":"libcastor-jdo-java","binary_version":"1.3.2-6"},{"binary_name":"libcastor-xml-java","binary_version":"1.3.2-6"},{"binary_name":"libcastor-xml-schema-java","binary_version":"1.3.2-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-7"],"ecosystem_specific":{"binaries":[{"binary_name":"libcastor-anttasks-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-codegen-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-core-java"},{"binary_name":"libcastor-ddlgen-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-jdo-java"},{"binary_version":"1.3.2-7","binary_name":"libcastor-xml-java"},{"binary_name":"libcastor-xml-schema-java","binary_version":"1.3.2-7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-7"],"ecosystem_specific":{"binaries":[{"binary_name":"libcastor-anttasks-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-codegen-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-core-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-ddlgen-java"},{"binary_name":"libcastor-jdo-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-xml-java"},{"binary_version":"1.3.2-7","binary_name":"libcastor-xml-schema-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-7"],"ecosystem_specific":{"binaries":[{"binary_name":"libcastor-anttasks-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-codegen-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-core-java"},{"binary_name":"libcastor-ddlgen-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-jdo-java"},{"binary_name":"libcastor-xml-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-xml-schema-java","binary_version":"1.3.2-7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/castor?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-7"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.2-7","binary_name":"libcastor-anttasks-java"},{"binary_name":"libcastor-codegen-java","binary_version":"1.3.2-7"},{"binary_name":"libcastor-core-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-ddlgen-java"},{"binary_version":"1.3.2-7","binary_name":"libcastor-jdo-java"},{"binary_name":"libcastor-xml-java","binary_version":"1.3.2-7"},{"binary_version":"1.3.2-7","binary_name":"libcastor-xml-schema-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}},{"package":{"name":"castor","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/castor?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-7","1.3.2-7build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.3.2-7build1","binary_name":"libcastor-anttasks-java"},{"binary_name":"libcastor-codegen-java","binary_version":"1.3.2-7build1"},{"binary_name":"libcastor-core-java","binary_version":"1.3.2-7build1"},{"binary_name":"libcastor-ddlgen-java","binary_version":"1.3.2-7build1"},{"binary_name":"libcastor-jdo-java","binary_version":"1.3.2-7build1"},{"binary_name":"libcastor-xml-java","binary_version":"1.3.2-7build1"},{"binary_version":"1.3.2-7build1","binary_name":"libcastor-xml-schema-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-3004.json"}}],"schema_version":"1.7.5","severity":[{"type":"Ubuntu","score":"medium"}]}