FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
3dbe9492-f7b8-11e7-a12d-6cc21735f730shibboleth-sp -- vulnerable to forged user attribute data

Shibboleth consortium reports:

Shibboleth SP software vulnerable to forged user attribute data

The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing.

Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

While newer versions of the xerces-c3 parser are configured by the SP into disallowing the use of a DTD via an environment variable, this feature is not present in the xerces-c3 parser before version 3.1.4, so an additional fix is being provided now that an actual DTD exploit has been identified. Xerces-c3-3.1.4 was committed to the ports tree already on 2016-07-26.


Discovery 2018-01-12
Entry 2018-01-12
xmltooling
< 1.6.3

xerces-c3
< 3.1.4

https://shibboleth.net/community/advisories/secadv_20180112.txt
CVE-2018-0486
a7f2e9c6-de20-11e5-8458-6cc21735f730xerces-c3 -- Parser Crashes on Malformed Input

The Apache Software Foundation reports:

The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.


Discovery 2016-02-25
Entry 2016-02-28
xerces-c3
< 3.1.3

CVE-2016-0729
http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt
cb09a7aa-5344-11e6-a7bd-14dae9d210b8xercesi-c3 -- multiple vulnerabilities

Apache reports:

The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker.

Also, CVE-2016-2099: Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.


Discovery 2016-05-09
Entry 2016-07-26
xerces-c3
< 3.1.4

https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt
http://www.openwall.com/lists/oss-security/2016/05/09/7
CVE-2016-2099
CVE-2016-4463
22438240-1bd0-11e8-a2ec-6cc21735f730shibboleth-sp -- vulnerable to forged user attribute data

Shibboleth consortium reports:

Shibboleth SP software vulnerable to additional data forgery flaws

The XML processing performed by the Service Provider software has been found to be vulnerable to new flaws similar in nature to the one addressed in an advisory last month.

These bugs involve the use of other XML constructs rather than entity references, and therefore required additional mitigation once discovered. As with the previous issue, this flaw allows for changes to an XML document that do not break a digital signature but can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

As before, the use of XML Encryption is a significant mitigation, but we have not dismissed the possibility that attacks on the Response "envelope" may be possible, in both the original and this new case. No actual attacks of this nature are known, so deployers should prioritize patching systems that expect to handle unencrypted SAML assertions.

An updated version of XMLTooling-C (V1.6.4) is available that protects against these new attacks, and should help prevent similar vulnerabilities in the future.

Unlike the previous case, these bugs are NOT prevented by any existing Xerces-C parser version on any platform and cannot be addressed by any means other than the updated XMLTooling-C library.

The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing.

Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

While newer versions of the xerces-c3 parser are configured by the SP into disallowing the use of a DTD via an environment variable, this feature is not present in the xerces-c3 parser before version 3.1.4, so an additional fix is being provided now that an actual DTD exploit has been identified. Xerces-c3-3.1.4 was committed to the ports tree already on 2016-07-26.


Discovery 2018-02-27
Entry 2018-02-27
xmltooling
< 1.6.4

xerces-c3
< 3.1.4

https://shibboleth.net/community/advisories/secadv_20180227.txt
CVE-2018-0489