Univention Bugzilla – Bug 47522
xml-security-c: Multiple issues (4.2)
Last modified: 2018-08-15 16:19:50 CEST
New Debian xml-security-c 1.7.2-3+deb8u1 fixes: This update addresses the following issue(s): * TEMP-0905332-CB57BF is resolved 1.7.2-3+deb8u1 (Sun, 05 Aug 2018 20:01:03 +0200) * [109db8e] New patch: Default KeyInfo resolver doesn't check for empty element content. The Apache Santuario XML Security for C++ library contained a number of code paths at risk of dereferencing null pointers when processing various kinds of malformed KeyInfo hints typically found in signed or encrypted XML. The usual effect is a crash, and in the case of the Shibboleth SP software, a crash in the shibd daemon. Upstream bug: https://issues.apache.org/jira/projects/SANTUARIO/issues/SANTUARIO-491 CVE: not assigned yet Thanks to Scott Cantor * [4dafdb4] Replace Russ in Uploaders
--- mirror/ftp/4.2/unmaintained/4.2-0/source/xml-security-c_1.7.2-3.dsc +++ apt/ucs_4.2-0-errata4.2-4/source/xml-security-c_1.7.2-3+deb8u1.dsc @@ -1,3 +1,18 @@ +1.7.2-3+deb8u1 [Sun, 05 Aug 2018 20:01:03 +0200] Ferenc Wágner <wferi@debian.org>: + + * [109db8e] New patch: Default KeyInfo resolver doesn't check for empty + element content. + The Apache Santuario XML Security for C++ library contained a + number of code paths at risk of dereferencing null pointers when + processing various kinds of malformed KeyInfo hints typically found + in signed or encrypted XML. The usual effect is a crash, and in the + case of the Shibboleth SP software, a crash in the shibd daemon. + Upstream bug: + https://issues.apache.org/jira/projects/SANTUARIO/issues/SANTUARIO-491 + CVE: not assigned yet + Thanks to Scott Cantor (Closes: #905332) + * [4dafdb4] Replace Russ in Uploaders + 1.7.2-3 [Mon, 07 Apr 2014 17:10:56 -0700] Russ Allbery <rra@debian.org>: * Avoid use of PATH_MAX where possible by using getcwd to allocate the <http://10.200.17.11/4.2-4/#2268654937856334235>
OK: patch OK: piuparts OK: yaml OK: errata-announce [4.2-4] 9e02b0275e Bug #47522: xml-security-c 1.7.2-3+deb8u1 doc/errata/staging/xml-security-c.yaml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) [4.2-4] 3f61d8666c Bug #47522: xml-security-c 1.7.2-3+deb8u1 doc/errata/staging/xml-security-c.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+)
<http://errata.software-univention.de/ucs/4.2/489.html>