Unscored severity · published Aug 20, 2013
CVE-2013-2210
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent…
–
CVSS
6%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XS
Xml Security For C++ · Apache
through 1.7.1; 0.1.0; 0.2.0; 1.1.0; 1.2.0; 1.2.1; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2210
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0216.html
Vendor Advisory
http://santuario.apache.org/secadv.data/CVE-2013-2210.txt
www.debian.org
http://www.debian.org/security/2013/dsa-2717
lists.apache.org
https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E
www.tenable.com
https://www.tenable.com/security/tns-2018-15
More from Xml Security For C++
–
CVE-2013-2156
Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before…
–
CVE-2013-2155
Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or…
–
CVE-2013-2154
Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1…
–
CVE-2013-2153
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers…
–
CVE-2011-2516
Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to…