CVE-2013-2153

The XML digital signature functionality xsec/dsig/DSIGReference.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypas...

CVE-2013-2210

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.2 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this...

CVE-2013-2155

CVE-2013-2155 affects Apache Santuario XML Security for C++ (xml-security-c) prior to 1.7.1. The issue is failure to properly validate length values, allowing remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof signatures via crafted length val...

CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2154

Stack-based buffer overflow in the XML Signature Reference functionality xsec/dsig/DSIGReference.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via malformed...

CVE-2013-2155

Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the 1...

CVE-2013-2155

Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the 1...

CVE-2013-2156

Heap-based buffer overflow in the Exclusive Canonicalization functionality xsec/canon/XSECC14n20010315.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted PrefixLi...

CVE-2013-2154

The CVE-2013-2154 entry affects Apache Santuario XML Security for C++ (xml-security-c) before 1.7.1, with a stack-based buffer overflow in DSIGReference::getURIBaseTXFM potentially allowing denial of service and, in some cases, arbitrary code execution via malformed XPointer expressions. Related ...

CVE-2013-2156

The CVE-2013-2156 entry concerns Apache Santuario XML Security for C++ (xml-security-c) prior to 1.7.1. A heap-based buffer overflow occurs in the PrefixList attribute handling within the Exclusive Canonicalization code (XSECC14n20010315.cpp), enabling a remote attacker to cause a denial of servi...

CVE-2013-2210

CVE-2013-2210: Heap-based buffer overflow in the XML Signature Reference functionality of Apache Santuario XML Security for C++ (xml-security-c) prior to 1.7.2. Causes DoS (crash) and potentially arbitrary code execution via malformed XPointer expressions, stemming from an incorrect fix for CVE-2...

CVE-2013-2172

CVE-2013-2172 affects Apache Santuario XML Security for Java (1.4.x < 1.4.8; 1.5.x

CVE-2013-2154: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the XML Signature Reference functionality xsec/dsig/DSIGReference.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via malformed...

CVE-2013-2210: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.2 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this...

UBUNTU-CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2172

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2172: Undefined Security Weakness

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization...

CVE-2013-2153: Undefined Security Weakness

The XML digital signature functionality xsec/dsig/DSIGReference.cpp in Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypas...

PT-2013-1364 · Apache · Apache Santuario Xml Security For Java

Name of the Vulnerable Software and Affected Versions: Apache Santuario XML Security for Java versions 1.5.5 and earlier Description: The issue allows remote attackers to cause a denial of service, specifically memory consumption, via crafted Document Type Definitions DTDs when applying Transform...

CVE-2013-2155: Improper Input Validation

Apache Santuario XML Security for C++ aka xml-security-c before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the 1...