Vulnerability CVE-2015-0851
Published: 2015-08-12

Description:
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Xmltooling project -> Xmltooling 

 References:
http://shibboleth.net/community/advisories/secadv_20150721.txt
http://www.debian.org/security/2015/dsa-3321
http://www.securityfocus.com/bid/76134
https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commitdiff;h=2d795c731e6729309044607154978696a87fd900
Copyright 2024, cxsecurity.com

 

Back to Top