Summary
Jon Erickson of iSIGHT Partners Labs discovered a heap overflow in xml-security-c, an implementation of the XML Digital Security specification. The fix to address
CVE-2013-2154
introduced the
possibility of a heap overflow in the processing of malformed XPointer expressions in the XML Signature Reference processing code, possibly leading to arbitrary code execution.
Solution
For the oldstable distribution (squeeze), this problem has been fixed in version 1.5.1-3+squeeze3.
For the stable distribution (wheezy), this problem has been fixed in version 1.6.1-5+deb7u2.
For the unstable distribution (sid), this problem has been fixed in version 1.6.1-7.
We recommend that you upgrade your xml-security-c packages.
Insight
XML-Security-C is a library for the XML Digital Security specification.
It provides processing and handling of XML Key Management Specifications (XKMS) messages.
Affected
xml-security-c on Debian Linux
Detection
This check tests the installed software version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-2154, CVE-2013-2210 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities