Debian Security Advisory DSA 2710-1 (xml-security-c - several vulnerabilities)

James Forshaw from Context Information Security discovered several vulnerabilities in xml-security-c, an implementation of the XML Digital Security specification. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-2153 The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content. CVE-2013-2154 A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed XPointer expressions in the XML Signature Reference processing code. CVE-2013-2155 A bug in the processing of the output length of an HMAC-based XML Signature would cause a denial of service when processing specially chosen input. CVE-2013-2156 A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitrary code execution.

xml-security-c on Debian Linux

This check tests the installed software version using the apt package manager.

For the oldstable distribution (squeeze), these problems have been fixed in version 1.5.1-3+squeeze2. For the stable distribution (wheezy), these problems have been fixed in version 1.6.1-5+deb7u1. For the unstable distribution (sid), these problems have been fixed in version 1.6.1-6. We recommend that you upgrade your xml-security-c packages.