CVE-2011-2516

Published: Jul 11, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.

Affected (16)

Products: Apache: Xml Security For C++ · Shibboleth: Shibboleth Sp

1 product

Xml Security For C++

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Apache Xml Security For C++	Version 1.6.0
Shibboleth Shibboleth Sp	version ≤ 2.4.2
Shibboleth Shibboleth Sp	Version 1.3.1
Shibboleth Shibboleth Sp	Version 1.3.2
Shibboleth Shibboleth Sp	Version 1.3.3
Shibboleth Shibboleth Sp	Version 1.3.4
Shibboleth Shibboleth Sp	Version 1.3.5
Shibboleth Shibboleth Sp	Version 1.3f
Shibboleth Shibboleth Sp	Version 2.0
Shibboleth Shibboleth Sp	Version 2.1
Shibboleth Shibboleth Sp	Version 2.2.1
Shibboleth Shibboleth Sp	Version 2.2
Shibboleth Shibboleth Sp	Version 2.3.1
Shibboleth Shibboleth Sp	Version 2.3
Shibboleth Shibboleth Sp	Version 2.4.1
Shibboleth Shibboleth Sp	Version 2.4

Related CWEs

References (32)

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063159.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063229.html

Source: secalert@redhat.com

http://santuario.apache.org/secadv/CVE-2011-2516.txt

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/45151

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/45191

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/45198

Source: secalert@redhat.com

http://secunia.com/advisories/45491

Source: secalert@redhat.com

http://shibboleth.internet2.edu/secadv/secadv_20110706.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2011/dsa-2277

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/518756/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/48611

Source: secalert@redhat.com

http://www.securitytracker.com/id?1025755

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/68420

Source: secalert@redhat.com

https://issues.apache.org/jira/browse/SANTUARIO-271

Source: secalert@redhat.com

Exploit

https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063159.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063229.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://santuario.apache.org/secadv/CVE-2011-2516.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/45151

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/45191

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/45198

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45491

Source: af854a3a-2127-422b-91ae-364da2661108

http://shibboleth.internet2.edu/secadv/secadv_20110706.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2011/dsa-2277

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/518756/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/48611

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025755

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/68420

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.apache.org/jira/browse/SANTUARIO-271

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.