{"id":"MGASA-2014-0155","summary":"Updated springframework packages fix multiple vulnerabilities","details":"Updated springframework packages fix security vulnerabilities:\n\nJaxb2RootElementHttpMessageConverter in Spring MVC processes external XML\nentities (CVE-2014-0054).\n\nSpring MVC introduces a cross-site scripting vulnerability if the action on a\nSpring form is not specified (CVE-2014-1904).\n","modified":"2026-04-16T01:48:29.939447578Z","published":"2014-04-03T01:07:29Z","upstream":["CVE-2014-0054","CVE-2014-1904"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0155.html"},{"type":"WEB","url":"http://www.gopivotal.com/security/cve-2014-0054"},{"type":"WEB","url":"http://www.gopivotal.com/security/cve-2014-1904"},{"type":"WEB","url":"http://www.debian.org/security/2014/dsa-2890"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13126"}],"affected":[{"package":{"name":"springframework","ecosystem":"Mageia:3","purl":"pkg:rpm/mageia/springframework?arch=source&distro=mageia-3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-21.3.mga3"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0155.json"}},{"package":{"name":"springframework","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/springframework?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-2.2.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0155.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}