[SECURITY] [DLA 259-1] shibboleth-sp2 security update

2015-06-2922:11:30

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

AI Score

5.9

Confidence

High

EPSS

0.004

Percentile

74.2%

JSON

Package : shibboleth-sp2
Version : 2.3.1+dfsg-5+deb6u1
CVE ID : CVE-2015-2684

A denial of service vulnerability was found in the Shibboleth (an
federated identity framework) Service Provider. When processing certain
malformed SAML message generated by an authenticated attacker, the daemon
could crash.

For the Debian 6 “Squeeze” distribution, this problem has been fixed in
version 2.3.1+dfsg-5+deb6u1.

We recommend that you upgrade your shibboleth-sp2 packages.

–
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian7amd64libshibsp5< 2.4.3+dfsg-5+deb7u1libshibsp5_2.4.3+dfsg-5+deb7u1_amd64.deb
Debian7s390libapache2-mod-shib2< 2.4.3+dfsg-5+deb7u1libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_s390.deb
Debian7ia64libshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_ia64.deb
Debian7kfreebsd-i386libapache2-mod-shib2< 2.4.3+dfsg-5+deb7u1libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_kfreebsd-i386.deb
Debian7armhflibshibsp5< 2.4.3+dfsg-5+deb7u1libshibsp5_2.4.3+dfsg-5+deb7u1_armhf.deb
Debian7armellibshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_armel.deb
Debian7i386libshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_i386.deb
Debian6amd64libapache2-mod-shib2< 2.3.1+dfsg-5+deb6u1libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_amd64.deb
Debian7amd64libshibsp-dev< 2.4.3+dfsg-5+deb7u1libshibsp-dev_2.4.3+dfsg-5+deb7u1_amd64.deb
Debian6i386libapache2-mod-shib2< 2.3.1+dfsg-5+deb6u1libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	amd64	libshibsp5	< 2.4.3+dfsg-5+deb7u1	libshibsp5_2.4.3+dfsg-5+deb7u1_amd64.deb
Debian	7	s390	libapache2-mod-shib2	< 2.4.3+dfsg-5+deb7u1	libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_s390.deb
Debian	7	ia64	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_ia64.deb
Debian	7	kfreebsd-i386	libapache2-mod-shib2	< 2.4.3+dfsg-5+deb7u1	libapache2-mod-shib2_2.4.3+dfsg-5+deb7u1_kfreebsd-i386.deb
Debian	7	armhf	libshibsp5	< 2.4.3+dfsg-5+deb7u1	libshibsp5_2.4.3+dfsg-5+deb7u1_armhf.deb
Debian	7	armel	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_armel.deb
Debian	7	i386	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_i386.deb
Debian	6	amd64	libapache2-mod-shib2	< 2.3.1+dfsg-5+deb6u1	libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_amd64.deb
Debian	7	amd64	libshibsp-dev	< 2.4.3+dfsg-5+deb7u1	libshibsp-dev_2.4.3+dfsg-5+deb7u1_amd64.deb
Debian	6	i386	libapache2-mod-shib2	< 2.3.1+dfsg-5+deb6u1	libapache2-mod-shib2_2.3.1+dfsg-5+deb6u1_i386.deb