Every CVE Search/ Get API key

CVE-2013-2210

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML...

7.5 HighFix available

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Exploit likelihood

6.02%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
CVE-2013-2210
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
CVE-2013-2210
Updated
2026-11-02
EUVDEUVD-2013-2164 No score

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
EUVD-2013-2164
Updated
2026-11-03
GitHub AdvisoriesGHSA-3gh6-67w4-wv53 No score

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML...

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
GHSA-3gh6-67w4-wv53
Weakness
CWE-119
Updated
2026-11-02
OSV No score

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
CVE-2013-2210
Updated
2026-11-02
OSVDEBIAN-CVE-2013-2210 No score

Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions. NOTE: this is due to an incorrect fix for CVE-2013-2154.

Record
DEBIAN-CVE-2013-2210
Updated
2026-11-02
OSVMGASA-2013-0193 No score

Updated xml-security-c package fixes multiple security vulnerabilities

The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content (CVE-2013-2153).

A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed XPointer expressions in the XML Signature Reference processing code (CVE-2013-2154).

A bug in the processing of the output length of an HMAC-based XML Signature would cause a denial of service when processing specially chosen input (CVE-2013-2155).

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitrary code execution (CVE-2013-2156).

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code (CVE-2013-2210).

Record
MGASA-2013-0193
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xml-security-c
Debian:12
 before 1.6.1-7
1.6.1-7
xml-security-c
Debian:13
 before 1.6.1-7
1.6.1-7
xml-security-c
Debian:14
 before 1.6.1-7
1.6.1-7
xml-security-c
Debian:6.0
 before 1.5.1-3+squeeze3, plus listed versions
1.5.1-31.5.1-3+squeeze11.5.1-3+squeeze1~bpo50+11.5.1-3+squeeze2
1.5.1-3+squeeze3
xml-security-c
Debian:7
 before 1.6.1-5+deb7u2, plus listed versions
1.6.1-51.6.1-5+deb7u11.6.1-5+deb7u1~bpo60+11.6.1-5+deb7u2~bpo60+1
1.6.1-5+deb7u2
xml-security-c
Mageia:2
From an advisory covering 5 CVEs
 before 1.6.1-1.2.mga2
1.6.1-1.2.mga2
xml-security-c
Mageia:3
From an advisory covering 5 CVEs
 before 1.7.0-2.2.mga3
1.7.0-2.2.mga3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2210 is a high vulnerability (CVSS 7.5) in Apache Xml Security For C\+\+, published June 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.02%, the 93rd percentile. Fixed in xml-security-c 1.6.1-7.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open