CVE-2015-0851
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not...
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
Exploit likelihood
What each source reports
NVD Score used
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
CVE-2015-0851- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
CVE-2015-0851- Updated
- 2026-11-02
EUVDEUVD-2015-0862 No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
EUVD-2015-0862- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2px9-x675-rqf5 No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not...
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
GHSA-2px9-x675-rqf5- Updated
- 2026-11-02
OSV No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
CVE-2015-0851- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0851 No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
DEBIAN-CVE-2015-0851- Updated
- 2026-11-02
OSVMGASA-2015-0350 No score
Updated xmltooling packages fix CVE-2015-0851
Updated xmltooling and opensaml packages fix security vulnerability:
The InCommon Shibboleth Training team discovered that XMLTooling, a C++ XML parsing library, did not properly handle an exception when parsing well-formed but schema-invalid XML. This could allow remote attackers to cause a denial of service (crash) via crafted XML data (CVE-2015-0851).
- Record
MGASA-2015-0350- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0851 No score
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
- Record
UBUNTU-CVE-2015-0851- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmltoolingDebian:12 |
before 1.5.6-1 | 1.5.6-1 |
xmltoolingDebian:13 |
before 1.5.6-1 | 1.5.6-1 |
xmltoolingDebian:14 |
before 1.5.6-1 | 1.5.6-1 |
xmltoolingDebian:6.0 |
before 1.3.3-2+deb6u1, plus listed versions 1.3.3-2 |
1.3.3-2+deb6u1 |
xmltoolingDebian:7 |
before 1.4.2-5+deb7u1, plus listed versions 1.4.2-5 |
1.4.2-5+deb7u1 |
xmltoolingDebian:8 |
before 1.5.3-2+deb8u1, plus listed versions 1.5.3-2 |
1.5.3-2+deb8u1 |
xmltoolingMageia:4 |
before 1.5.3-3.1.mga4 | 1.5.3-3.1.mga4 |
opensamlMageia:4 |
before 2.5.2-4.1.mga4 | 2.5.2-4.1.mga4 |
xmltoolingMageia:5 |
before 1.5.3-5.1.mga5 | 1.5.3-5.1.mga5 |
opensamlMageia:5 |
before 2.5.2-6.1.mga5 | 2.5.2-6.1.mga5 |
xmltoolingUbuntu:14.04:LTS |
before 1.5.3-2+deb8u1build0.14.04.1, plus listed versions 1.5.3-2 |
1.5.3-2+deb8u1build0.14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0851 is a medium vulnerability (CVSS 5.0) in Xmltooling Project Xmltooling, published July 30, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in xmltooling 1.5.6-1.
References
shibboleth.net/community/advisories/secadv_20150721.txt
git.shibboleth.net/view?p=cpp-xmltooling.git%3Ba=commitdiff%3Bh=2d795c731e6729309044607154978696a87fd900
securityfocus.com/bid/76134
debian.org/security/2015/dsa-3321
nvd.nist.gov/vuln/detail/CVE-2015-0851