CVE-2018-0486 Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attac...
MediumCVSS 6.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xmltooling(Debian:12) | < 1.6.3-1 | 1.6.3-1 |
| debian/xmltooling(Debian:13) | < 1.6.3-1 | 1.6.3-1 |
| debian/xmltooling(Debian:14) | < 1.6.3-1 | 1.6.3-1 |
| shibboleth xmltooling-c | < 1.6.3 | 1.6.3 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-0486 vendor-advisory
- 1040177 third-party-advisory vdb-entry
- [debian-lts-announce] 20180114 [SECURITY] [DLA 1242-1] xmltooling security update mailing-list third-party-advisory
- lists.debian.org mailing-list third-party-advisory
- shibboleth.net vendor-advisory
- DSA-4085 third-party-advisory vendor-advisory