CVE-2019-9628
XMLTooling Library Incorrectly Handles Some Exceptions
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
CVE-2019-9628- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-755
- Updated
- 2026-11-02
CVE List No score
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
CVE-2019-9628- Updated
- 2026-11-02
EUVDEUVD-2022-2804 No score
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
EUVD-2022-2804- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6hvf-xvwm-vrw4
XMLTooling Library Incorrectly Handles Some Exceptions
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
GHSA-6hvf-xvwm-vrw4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSV
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
CVE-2019-9628- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
DEBIAN-CVE-2019-9628- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-6hvf-xvwm-vrw4
XMLTooling Library Incorrectly Handles Some Exceptions
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
GHSA-6hvf-xvwm-vrw4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
- Record
UBUNTU-CVE-2019-9628- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1235-1 No score
Security update for xmltooling
This update for xmltooling fixes the following issues:
Security issue fixed:
- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1235-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11523-1 No score
libxmltooling-devel-3.2.0-1.2 on GA media
These are all security issues fixed in the libxmltooling-devel-3.2.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11523-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0928-1 No score
Security update for xmltooling
This update for xmltooling fixes the following issue:
Security issue fixed:
- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537).
- Record
SUSE-SU-2019:0928-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0929-1 No score
Security update for xmltooling
This update for xmltooling fixes the following issues:
Security issue fixed:
- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537).
- Record
SUSE-SU-2019:0929-1- Updated
- 2026-11-02
OSVUSN-3921-1 No score
xmltooling vulnerability
It was discovered that XMLTooling incorrectly handled certain XML files with invalid data. An attacker could use this issue to cause XMLTooling to crash, resulting in a denial of service.
- Record
USN-3921-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmltoolingDebian:12 |
before 3.0.4-1 | 3.0.4-1 |
xmltoolingDebian:13 |
before 3.0.4-1 | 3.0.4-1 |
xmltoolingDebian:14 |
before 3.0.4-1 | 3.0.4-1 |
xmltoolingDebian:8 |
before 1.5.3-2+deb8u4, plus listed versions 1.5.3-21.5.3-2+deb8u11.5.3-2+deb8u21.5.3-2+deb8u3 |
1.5.3-2+deb8u4 |
xmltoolingDebian:9 |
before 1.6.0-4+deb9u2, plus listed versions 1.6.0-41.6.0-4+deb9u11.6.0-4+deb9u1~bpo8+1 |
1.6.0-4+deb9u2 |
xmltoolingSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
xmltoolingSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
xmltoolingSUSE:Linux Enterprise Server 12 SP3 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
xmltoolingSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
xmltoolingSUSE:Linux Enterprise Server 12 SP4 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xmltoolingSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.5.6-3.9.1 | 1.5.6-3.9.1 |
xmltoolingSUSE:Linux Enterprise Module for Server Applications 15 |
before 1.6.4-3.3.2 | 1.6.4-3.3.2 |
xmltoolingUbuntu:14.04:LTS |
before 1.5.3-2+deb8u3ubuntu0.1, plus listed versions 1.5.3-21.5.3-2+deb8u1build0.14.04.11.5.3-2+deb8u2build0.14.04.11.5.3-2+deb8u3build0.14.04.1 |
1.5.3-2+deb8u3ubuntu0.1 |
xmltoolingUbuntu:16.04:LTS |
before 1.5.6-2ubuntu0.3, plus listed versions 1.5.3-2.1ubuntu21.5.6-11.5.6-21.5.6-2ubuntu0.11.5.6-2ubuntu0.2 |
1.5.6-2ubuntu0.3 |
xmltoolingUbuntu:18.04:LTS |
before 1.6.4-1ubuntu2.1, plus listed versions 1.6.0-51.6.0-5build11.6.2-11.6.3-11.6.4-1ubuntu2 |
1.6.4-1ubuntu2.1 |
xmltoolingopenSUSE:Leap 15.0 |
before 1.6.4-lp150.2.3.1 | 1.6.4-lp150.2.3.1 |
xmltoolingopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 3.2.0-1.2 | 3.2.0-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9628 is a high vulnerability (CVSS 7.5) in Xmltooling Project Xmltooling, published March 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in xmltooling 3.0.4-1.
References
shibboleth.net/community/advisories/secadv_20190311.txt
usn.ubuntu.com/3921-1
wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories
bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912
lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html
Show 16 moreShow less
security.netapp.com/advisory/ntap-20190611-0003
nvd.nist.gov/vuln/detail/CVE-2019-9628
github.com/advisories/GHSA-6hvf-xvwm-vrw4
security-tracker.debian.org/tracker/CVE-2019-9628
suse.com/support/update/announcement/2019/suse-su-20190928-1
bugzilla.suse.com/1129537
ubuntu.com/security/CVE-2019-9628
issues.shibboleth.net/jira/browse/CPPXT-143
git.shibboleth.net/view?p=cpp-xmltooling.git;a=commit;h=af27c422f551e16989ff6f1722d83614c8550eb5
cve.org/CVERecord?id=CVE-2019-9628