CVE-2011-2516
11.07.2011, 20:55
Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | xml_security_for_c\+\+ | 1.6.0 |
| shibboleth | shibboleth-sp | 𝑥 ≤ 2.4.2 |
| shibboleth | shibboleth-sp | 1.3.1 |
| shibboleth | shibboleth-sp | 1.3.2 |
| shibboleth | shibboleth-sp | 1.3.3 |
| shibboleth | shibboleth-sp | 1.3.4 |
| shibboleth | shibboleth-sp | 1.3.5 |
| shibboleth | shibboleth-sp | 1.3f:f |
| shibboleth | shibboleth-sp | 2.0 |
| shibboleth | shibboleth-sp | 2.1 |
| shibboleth | shibboleth-sp | 2.2 |
| shibboleth | shibboleth-sp | 2.2.1 |
| shibboleth | shibboleth-sp | 2.3 |
| shibboleth | shibboleth-sp | 2.3.1 |
| shibboleth | shibboleth-sp | 2.4 |
| shibboleth | shibboleth-sp | 2.4.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| shibboleth-sp2 |
| ||||||||||||||||||||||||||||||||||
| xml-security-c |
|
Common Weakness Enumeration
References