CVE-2014-3600

NameCVE-2014-3600
DescriptionXML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs777196

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
activemq (PTS)wheezy5.6.0+dfsg-1+deb7u2fixed
wheezy (security)5.6.0+dfsg-1+deb7u3fixed
jessie5.6.0+dfsg1-4+deb8u3fixed
jessie (security)5.6.0+dfsg1-4+deb8u2fixed
stretch5.14.3-3fixed
buster5.14.5-3fixed
sid5.15.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
activemqsource(unstable)5.6.0+dfsg1-4low777196
activemqsourcewheezy5.6.0+dfsg-1+deb7u1high

Notes

http://activemq.apache.org/security-advisories.data/CVE-2014-3600-announcement.txt

Search for package or bug name: Reporting problems