CVE-2019-9628

2019-03-1200:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.025

Percentile

90.3%

JSON

The XMLTooling library all versions prior to V3.0.4, provided with the
OpenSAML and Shibboleth Service Provider software, contains an XML parsing
class. Invalid data in the XML declaration causes an exception of a type
that was not handled properly in the parser class and propagates an
unexpected exception type.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchxmltooling< 1.6.4-1ubuntu2.1UNKNOWN
ubuntu18.10noarchxmltooling< 3.0.2-1ubuntu1.1UNKNOWN
ubuntu14.04noarchxmltooling< 1.5.3-2+deb8u3ubuntu0.1UNKNOWN
ubuntu16.04noarchxmltooling< 1.5.6-2ubuntu0.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	xmltooling	< 1.6.4-1ubuntu2.1	UNKNOWN
ubuntu	18.10	noarch	xmltooling	< 3.0.2-1ubuntu1.1	UNKNOWN
ubuntu	14.04	noarch	xmltooling	< 1.5.3-2+deb8u3ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	xmltooling	< 1.5.6-2ubuntu0.3	UNKNOWN