1. CVE-Search
  2. CVE-2011-2516
ID CVE-2011-2516
Summary Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
References
Vulnerable Configurations
  • cpe:2.3:a:apache:xml_security_for_c\+\+:1.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:xml_security_for_c\+\+:1.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:1.3f:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:1.3f:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.1:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.2:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.3:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.4:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:shibboleth:shibboleth-sp:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:shibboleth:shibboleth-sp:2.4.2:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 13-02-2023 - 01:19)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
bid 48611
bugtraq 20110707 Security Advisory: CVE-2011-2516
confirm
debian DSA-2277
fedora
  • FEDORA-2011-9494
  • FEDORA-2011-9501
mlist [santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html
sectrack 1025755
secunia
  • 45151
  • 45191
  • 45198
  • 45491
xf apache-xml-dos(68420)
Last major update 13-02-2023 - 01:19
Published 11-07-2011 - 20:55
Last modified 13-02-2023 - 01:19
Back to Top