what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Jon Erickson

Apache Santuario XML Security For C++ Heap Overflow

Posted Jun 27, 2013

Authored by Jon Erickson

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code. An attacker could use this to exploit an application performing signature verification if the application does not block the evaluation of such references prior to performing the verification step. The exploit would occur prior to the actual verification of the signature, so does not require authenticated content. Apache Santuario XML Security for C++ library versions prior to 1.7.2 are affected.

tags | advisory, overflow, arbitrary, code execution

advisories | CVE-2013-2154, CVE-2013-2210

SHA-256 | ed557eaf432b8220b8a580b3a0a313162a1d2211f6e1ea637a19dc2d29e16038

Download | Favorite | View