CVE-2015-0851
Published: 12 August 2015
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
opensaml2 Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(2.5.5-1)
|
| bionic |
Not vulnerable
(2.5.5-1)
|
|
| precise |
Ignored
(end of life)
|
|
| trusty |
Does not exist
(trusty was not-affected [2.5.3-2+deb8u1])
|
|
| upstream |
Released
(2.5.3-2+deb8u1 2.5.5)
|
|
| vivid |
Ignored
(end of life)
|
|
| wily |
Ignored
(end of life)
|
|
| xenial |
Not vulnerable
(2.5.5-1)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Not vulnerable
(2.5.5-1)
|
|
|
Patches: upstream: https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commitdiff;h=2d795c731e6729309044607154978696a87fd900 |
||
|
xmltooling Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(1.5.6-2)
|
| bionic |
Not vulnerable
(1.5.6-2)
|
|
| precise |
Ignored
(end of life)
|
|
| trusty |
Released
(1.5.3-2+deb8u1build0.14.04.1)
|
|
| upstream |
Released
(1.5.5)
|
|
| vivid |
Released
(1.5.3-2+deb8u1build0.15.04.1)
|
|
| wily |
Ignored
(end of life)
|
|
| xenial |
Not vulnerable
(1.5.6-2)
|
|
| yakkety |
Ignored
(end of life)
|
|
| zesty |
Not vulnerable
(1.5.6-2)
|
|
|
Patches: upstream: https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commitdiff;h=2d795c731e6729309044607154978696a87fd900 |
||