debian/xmlsec1 vulnerabilities

Latest debian/xmlsec1 CVEs

Newest publication first

1. CVE-2017-1000061 xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

   Published 2017-07-13

   High·CVSS 7.1 EPSS 1.4%

   xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

2. DSA-2219-1 xmlsec1 - file overwrite

   Published 2011-04-18

   Unknown

3. CVE-2011-1425 xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involv...

   Published 2011-04-03

   Medium·CVSS 5.1 EPSS 8.1% Public exploit

   xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature ver...

4. CVE-2009-3736 ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, w...

   Published 2009-11-27

   Medium·CVSS 6.9 EPSS 0.40%

   ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.

5. CVE-2009-0217 Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation

   Published 2009-07-14

   Medium·CVSS 5.0 EPSS 6.4%

   The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Pro...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.