Published: 11/04/2019 Updated: 18/04/2022

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

It exists that XMLTooling incorrectly handled certain XML files with invalid data. An attacker could use this issue to cause XMLTooling to crash, resulting in a denial of service.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xmltooling project xmltooling
canonical ubuntu linux 14.04
canonical ubuntu linux 16.04
canonical ubuntu linux 18.04
canonical ubuntu linux 18.10
opensuse leap 15.0
opensuse leap 42.3

Debian Bug report logs - #924346 xmltooling: CVE-2019-9628: XML parser class fails to trap exceptions on malformed XML declaration Package: src:xmltooling; Maintainer for src:xmltooling is Debian Shib Team <pkg-shibboleth-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, ...

xmltooling could be made to crash if it opened a specially crafted file ...

Ross Geerlings discovered that the XMLTooling library didn't correctly handle exceptions on malformed XML declarations, which could result in denial of service against the application using XMLTooling For the stable distribution (stretch), this problem has been fixed in version 160-4+deb9u2 We recommend that you upgrade your xmltooling packages ...

CWE-755 https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories https://usn.ubuntu.com/3921-1/https://shibboleth.net/community/advisories/secadv_20190311.txt https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html https://security.netapp.com/advisory/ntap-20190611-0003/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924346 https://usn.ubuntu.com/3921-1/https://nvd.nist.gov

CVE-2019-9628

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect