BSA-2017-471

Security Advisory ID : BSA-2017-471 Component : Apache Santuario Revision : 2.0: Final Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service memory consumption via crafted Document Type Definitions DTDs, related to...

CentOS 7 : xmlsec1 (CESA-2017:2492)

An update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

xmlsec1 security update

CentOS Errata and Security Advisory CESA-2017:2492 An update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Oracle Linux 7 : xmlsec1 (ELSA-2017-2492)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2492 advisory. - CVE-2017-1000061 - CVE-2017-1000061 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

RHEL 7 : xmlsec1 (RHSA-2017:2492)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2492 advisory. XML Security Library is a C library based on LibXML2 and OpenSSL. The library was created with a goal to support major XML security standards XML...

Moderate: Red Hat Security Advisory: xmlsec1 security update

An update for xmlsec1 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RedHat Update for xmlsec1 RHSA-2017:2492-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted

It was found that a flaw exists in JAX-RS clients using the streaming approach for XML signatures and encryption, where it does not enforce the message to be signed/encrypted. This could allow an attacker to subvert the integrity of the message...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

CVE-2017-1000061

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service...

Spoofed Server Attacks

cxf-rt-rs-security-xml is vulnerable to server spoofing attacks. The attacks are possible because the XML security clients fail to validate whether the JAX-RS service response is signed or encrypted...

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

Code injection

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-5653: Improper Certificate Validation

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

Bypass XML Signature Protection Mechanism

Apache Santuario XML Security is vulnerable to bypass attacks. Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows malicious users to remotely bypass the streaming XML signature protection mechanism. It does not affect versions 1.4.x or 1.5.x...

XMLSec Libxml2 XXE Vulnerability

XMLSec is a C-based library for implementing the XML security standard. libxml2 is a C-based library for parsing XML documents developed by the GNOME project. A security vulnerability exists in XMLSec 1.2.23 and earlier and Libxml2 2.9.4 and earlier used in other products. The vulnerability can b...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the xml-security-c package of the Debian GNU/Linux operating system can be exploited, leading to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962)

It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory...

PT-2015-6789

Name of the Vulnerable Software and Affected Versions ZendXml versions prior to 1.0.1 Zend Framework versions prior to 1.12.14 Zend Framework 2.x versions prior to 2.4.6 Zend Framework 2.5.x versions prior to 2.5.2 Description The issue allows remote attackers to bypass security checks and conduc...

Debian DLA-85-1 : libxml-security-java security update

James Forshaw discovered that, in Apache Santuario XML Security for Java, CanonicalizationMethod parameters were incorrectly validated: by specifying an arbitrary weak canonicalization algorithm, an attacker could spoof XML signatures. NOTE: Tenable Network Security has extracted the preceding...