Candidate: CVE-2011-2516
PublicDate: 2011-07-11 20:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2516
 http://santuario.apache.org/secadv/CVE-2011-2516.txt
Description:
 Off-by-one error in the XML signature feature in Apache XML Security for
 C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products,
 allows remote attackers to cause a denial of service (crash) via a
 signature using a large RSA key, which triggers a buffer overflow.
Ubuntu-Description:
Notes:
 sbeattie> shibboleth-sp2 apparently needs to be recompiled after the
 sbeattie> fix to xml-security-c
Bugs:
 https://bugs.launchpad.net/ubuntu/+source/xml-security-c/+bug/807414
 https://bugs.launchpad.net/ubuntu/+source/shibboleth-sp2/+bug/807416
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632973
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_xml-security-c:
upstream_xml-security-c: released (1.6.1)
hardy_xml-security-c: ignored (reached end-of-life)
lucid_xml-security-c: released (1.5.1-3+squeeze1build0.10.04.1)
maverick_xml-security-c: released (1.5.1-3+squeeze1build0.10.10.1)
natty_xml-security-c: released (1.5.1-3+squeeze1build0.11.04.1)
oneiric_xml-security-c: not-affected (1.6.1-1)
precise_xml-security-c: not-affected (1.6.1-1)
precise/esm_xml-security-c: DNE (precise was not-affected [1.6.1-1])
quantal_xml-security-c: not-affected (1.6.1-1)
raring_xml-security-c: not-affected (1.6.1-1)
saucy_xml-security-c: not-affected (1.6.1-1)
trusty_xml-security-c: not-affected (1.6.1-1)
trusty/esm_xml-security-c: DNE (trusty was not-affected [1.6.1-1])
utopic_xml-security-c: not-affected (1.6.1-1)
vivid_xml-security-c: not-affected (1.6.1-1)
vivid/stable-phone-overlay_xml-security-c: DNE
vivid/ubuntu-core_xml-security-c: DNE
wily_xml-security-c: not-affected (1.6.1-1)
xenial_xml-security-c: not-affected (1.6.1-1)
yakkety_xml-security-c: not-affected (1.6.1-1)
zesty_xml-security-c: not-affected (1.6.1-1)
artful_xml-security-c: not-affected (1.6.1-1)
devel_xml-security-c: not-affected (1.6.1-1)

Patches_shibboleth-sp2:
upstream_shibboleth-sp2: not-affected
hardy_shibboleth-sp2: DNE
lucid_shibboleth-sp2: ignored (reached end-of-life)
maverick_shibboleth-sp2: ignored (reached end-of-life)
natty_shibboleth-sp2: ignored (reached end-of-life)
oneiric_shibboleth-sp2: ignored (reached end-of-life)
precise_shibboleth-sp2: ignored (reached end-of-life)
precise/esm_shibboleth-sp2: DNE (precise was needed)
quantal_shibboleth-sp2: ignored (reached end-of-life)
raring_shibboleth-sp2: ignored (reached end-of-life)
saucy_shibboleth-sp2: ignored (reached end-of-life)
trusty_shibboleth-sp2: not-affected (2.5.2+dfsg-2)
trusty/esm_shibboleth-sp2: DNE (trusty was not-affected [2.5.2+dfsg-2])
utopic_shibboleth-sp2: ignored (reached end-of-life)
vivid_shibboleth-sp2: ignored (reached end-of-life)
vivid/stable-phone-overlay_shibboleth-sp2: DNE
vivid/ubuntu-core_shibboleth-sp2: DNE
wily_shibboleth-sp2: ignored (reached end-of-life)
xenial_shibboleth-sp2: not-affected (2.5.2+dfsg-2)
yakkety_shibboleth-sp2: ignored (reached end-of-life)
zesty_shibboleth-sp2: not-affected (2.5.2+dfsg-2)
artful_shibboleth-sp2: not-affected (2.5.2+dfsg-2)
devel_shibboleth-sp2: not-affected (2.5.2+dfsg-2)