Every CVESearch/Get API key

CVE-2013-2153

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML...

4.3 MediumFix available

CVE-2013-2153 is a medium vulnerability (CVSS 4.3) in Apache Xml Security For C\+\+, published June 18, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.77%, the 92nd percentile. Fixed in xml-security-c 1.6.1-6.

Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
4.77%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.6.1-6xml-security-c +6 more

Description

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Exploit likelihood

4.77%Up 3.0 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xml-security-c
Debian:12
before 1.6.1-6
1.6.1-6
xml-security-c
Debian:13
before 1.6.1-6
1.6.1-6
xml-security-c
Debian:14
before 1.6.1-6
1.6.1-6
xml-security-c
Debian:6.0
From an advisory covering 4 CVEs
before 1.5.1-3+squeeze2, plus listed versions
1.5.1-31.5.1-3+squeeze11.5.1-3+squeeze1~bpo50+1
1.5.1-3+squeeze2
xml-security-c
Debian:7
From an advisory covering 4 CVEs
before 1.6.1-5+deb7u1, plus listed versions
1.6.1-51.6.1-5+deb7u1~bpo60+1
1.6.1-5+deb7u1
xml-security-c
Mageia:2
From an advisory covering 5 CVEs
before 1.6.1-1.2.mga2
1.6.1-1.2.mga2
xml-security-c
Mageia:3
From an advisory covering 5 CVEs
before 1.7.0-2.2.mga3
1.7.0-2.2.mga3

What each source reports

NVD Score used4.3

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
CVE-2013-2153
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE ListNo score

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
CVE-2013-2153
Updated
2026-11-02
EUVDEUVD-2013-2118No score

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
EUVD-2013-2118
Updated
2026-11-03
GitHub AdvisoriesGHSA-3rvj-2vfj-frq8No score

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML...

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
GHSA-3rvj-2vfj-frq8
Updated
2026-11-02
OSVNo score

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
CVE-2013-2153
Updated
2026-11-02
OSVDEBIAN-CVE-2013-2153No score

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Record
DEBIAN-CVE-2013-2153
Updated
2026-11-02
OSVMGASA-2013-0193No score

Updated xml-security-c package fixes multiple security vulnerabilities

The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content (CVE-2013-2153).

A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed XPointer expressions in the XML Signature Reference processing code (CVE-2013-2154).

A bug in the processing of the output length of an HMAC-based XML Signature would cause a denial of service when processing specially chosen input (CVE-2013-2155).

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitrary code execution (CVE-2013-2156).

The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code (CVE-2013-2210).

Record
MGASA-2013-0193
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open