Published: 20/08/2013 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) prior to 1.7.1 allows context-dependent malicious users to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions, probably related to the DSIGReference::getURIBaseTXFM function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache xml security for c\\+\\+ 1.6.0
apache xml security for c\\+\\+ 1.1.0
apache xml security for c\\+\\+ 1.6.1
apache xml security for c\\+\\+ 1.2.1
apache xml security for c\\+\\+ 1.5.1
apache xml security for c\\+\\+ 1.5.0
apache xml security for c\\+\\+ 0.2.0
apache xml security for c\\+\\+ 1.3.0
apache xml security for c\\+\\+
apache xml security for c\\+\\+ 1.4.0
apache xml security for c\\+\\+ 1.3.1
apache xml security for c\\+\\+ 1.2.0
apache xml security for c\\+\\+ 0.1.0

Debian Bug report logs - #714241 xml-security-c: CVE-2013-2210 Package: xml-security-c; Maintainer for xml-security-c is Debian Shib Team <pkg-shibboleth-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 27 Jun 2013 07:03:01 UTC Severity: grave Tags: patch, security Fix ...

Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification The fix to address CVE-2013-2154 introduced the possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature Reference processing code, possibly leading to arbitra ...

James Forshaw from Context Information Security discovered several vulnerabilities in xml-security-c, an implementation of the XML Digital Security specification The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-2153 The implementation of XML digital signatures in the Santuario-C++ library is vul ...

CWE-119 http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/dsig/DSIGReference.cpp?r1=1125514&r2=1493959&pathrev=1493959&diff_format=h http://santuario.apache.org/secadv.data/CVE-2013-2154.txt http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0141.html http://www.debian.org/security/2013/dsa-2710 https://www.tenable.com/security/tns-2018-15 https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714241 https://nvd.nist.gov https://www.debian.org/security/./dsa-2717

CVE-2013-2154

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect