PT-2015-4918 · Shibboleth · Shibboleth Service Provider+2

Published 2015-07-30 · Updated 2016-11-28 · CVE-2015-0851

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions XMLTooling-C versions prior to 1.5.5 OpenSAML-C (affected versions not specified) Shibboleth Service Provider (SP) (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending schema-invalid XML data. This occurs due to improper handling of integer conversion exceptions.

Recommendations For XMLTooling-C versions prior to 1.5.5, update to version 1.5.5 or later to resolve the issue. For OpenSAML-C, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Shibboleth Service Provider (SP), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2015-0851

DLA-290-1

DSA-3321-1

DSA-3321-2

MGASA-2015-0350

Affected Products

Opensaml-C

Shibboleth Service Provider

Xmltooling-C

References · 25

• https://debian.org/security/2015/dsa-3321 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3321-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3321-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0851 · Security Note
• https://osv.dev/vulnerability/DSA-3321-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-0851 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3321-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/opensaml2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0350.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-0851 · Vendor Advisory
• http://debian.org/security/2015/dsa-3321 · Vendor Advisory
• http://shibboleth.net/community/advisories/secadv_20150721.txt · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0851 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0851 · Security Note