| Description: | Summary:
The remote host is missing an update for the 'xml-security-c' package(s) announced via the MGASA-2013-0193 advisory.
Vulnerability Insight:
The implementation of XML digital signatures in the Santuario-C++ library
is vulnerable to a spoofing issue allowing an attacker to reuse existing
signatures with arbitrary content (CVE-2013-2153).
A stack overflow, possibly leading to arbitrary code execution, exists in
the processing of malformed XPointer expressions in the XML Signature
Reference processing code (CVE-2013-2154).
A bug in the processing of the output length of an HMAC-based XML
Signature would cause a denial of service when processing specially chosen
input (CVE-2013-2155).
A heap overflow exists in the processing of the PrefixList attribute
optionally used in conjunction with Exclusive Canonicalization, potentially
allowing arbitrary code execution (CVE-2013-2156).
The attempted fix to address CVE-2013-2154 introduced the possibility of a
heap overflow, possibly leading to arbitrary code execution, in the
processing of malformed XPointer expressions in the XML Signature Reference
processing code (CVE-2013-2210).
Affected Software/OS:
'xml-security-c' package(s) on Mageia 2, Mageia 3.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
