PatchTheCVECVE-2013-4002: XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in
54
This week
HIGH 7.1WATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-2013-4002 is a high-severity flaw (CVSS 7.1) affecting java, jdk, jre. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to
Why this priority
- High severity
- EPSS top 2%: very likely to be exploited
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.1 (High) |
| EPSS exploit chance | 24.7% (top 2%) |
| CISA exploited list | No |
| Published | 2013-07-23 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
ibm java DOWNGRADE
Affected: 5.0.0.0 · 5.0.11.0 · 5.0.11.1 · 5.0.11.2 · 5.0.12.0 · 5.0.12.1 · 5.0.12.2 · 5.0.12.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.0.0.0
1. Check installed version
apt-cache policy java || rpm -q java || java --version
2. No fixed release: DOWNGRADE to a release before 5.0.0.0 (Debian / Ubuntu)
apt-cache madison java
sudo apt install java=<VERSION_BEFORE_5.0.0.0>
sudo apt-mark hold java
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list java
sudo dnf downgrade java-<VERSION_BEFORE_5.0.0.0>
sudo dnf versionlock add java
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle jdk DOWNGRADE
Affected: 1.5.0 update51 · 1.6.0 update60 · 1.7.0 update40
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.5.0
1. Check installed version
apt-cache policy jdk || rpm -q jdk || jdk --version
2. No fixed release: DOWNGRADE to a release before 1.5.0 (Debian / Ubuntu)
apt-cache madison jdk
sudo apt install jdk=<VERSION_BEFORE_1.5.0>
sudo apt-mark hold jdk
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jdk
sudo dnf downgrade jdk-<VERSION_BEFORE_1.5.0>
sudo dnf versionlock add jdk
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle jre DOWNGRADE
Affected: 1.5.0 update51 · 1.6.0 update60 · 1.7.0 update40
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.5.0
1. Check installed version
apt-cache policy jre || rpm -q jre || jre --version
2. No fixed release: DOWNGRADE to a release before 1.5.0 (Debian / Ubuntu)
apt-cache madison jre
sudo apt install jre=<VERSION_BEFORE_1.5.0>
sudo apt-mark hold jre
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jre
sudo dnf downgrade jre-<VERSION_BEFORE_1.5.0>
sudo dnf versionlock add jre
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle jrockit UPGRADE
Affected: >= r27.7.0 and <= r27.7.6 · >= r28.0.0 and <= r28.2.8
Fixed in: newer than r28.2.8
Safe to downgrade to: a release before r27.7.0
1. Check installed version
apt-cache policy jrockit || rpm -q jrockit || jrockit --version
2. UPGRADE to newer than r28.2.8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade jrockit
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade jrockit
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before r27.7.0 (Debian / Ubuntu)
apt-cache madison jrockit
sudo apt install jrockit=<VERSION_BEFORE_r27.7.0>
sudo apt-mark hold jrockit
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list jrockit
sudo dnf downgrade jrockit-<VERSION_BEFORE_r27.7.0>
sudo dnf versionlock add jrockit
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm sterling b2b integrator DOWNGRADE
Affected: 5.2.4 · 5.1 · 5.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.1
1. Check installed version
apt-cache policy sterling-b2b-integrator || rpm -q sterling-b2b-integrator || sterling-b2b-integrator --version
2. No fixed release: DOWNGRADE to a release before 5.1 (Debian / Ubuntu)
apt-cache madison sterling-b2b-integrator
sudo apt install sterling-b2b-integrator=<VERSION_BEFORE_5.1>
sudo apt-mark hold sterling-b2b-integrator
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sterling-b2b-integrator
sudo dnf downgrade sterling-b2b-integrator-<VERSION_BEFORE_5.1>
sudo dnf versionlock add sterling-b2b-integrator
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
ibm host on-demand DOWNGRADE
Affected: 11.0 · 11.0.1 · 11.0.2 · 11.0.3 · 11.0.4 · 11.0.5 · 11.0.5.1 · 11.0.6
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.0
1. Check installed version
apt-cache policy host-on-demand || rpm -q host-on-demand || host-on-demand --version
2. No fixed release: DOWNGRADE to a release before 11.0 (Debian / Ubuntu)
apt-cache madison host-on-demand
sudo apt install host-on-demand=<VERSION_BEFORE_11.0>
sudo apt-mark hold host-on-demand
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list host-on-demand
sudo dnf downgrade host-on-demand-<VERSION_BEFORE_11.0>
sudo dnf versionlock add host-on-demand
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2013-4002?
java: downgrade or apply the listed mitigation; jdk: downgrade or apply the listed mitigation; jre: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2013-4002 being exploited?
CVE-2013-4002 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2013-4002 affect?
CVE-2013-4002 affects java, jdk, jre. Severity is high (CVSS 7.1). XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and e
How urgent is CVE-2013-4002?
Priority 54/100. High severity; EPSS top 2%: very likely to be exploited; On your watchlist
Software pages
Related CVEs
- CVE-2023-30441 HIGH 7.5 DOWNGRADE UPGRADE IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could
- CVE-2021-25738 MEDIUM 6.7 UPGRADE Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
- CVE-2019-4473 HIGH 7.8 DOWNGRADE Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute R
- CVE-2015-1916 HIGH 7.5 DOWNGRADE Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via un
- CVE-2015-1914 MEDIUM 5.0 UPGRADE IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allow