{"id":"CVE-2013-2155","aliases":["DEBIAN-CVE-2013-2155","DSA-2710-1","EUVD-2013-2120","GHSA-pq9g-7grj-xrm8","MGASA-2013-0193"],"status":"published","title":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly...","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05805,"percentile":0.9318,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-06-18T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"xml-security-c","fixed_in":["1.6.1-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xml-security-c","fixed_in":["1.6.1-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xml-security-c","fixed_in":["1.6.1-6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-6"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-3+squeeze2"}]}],"versions":["1.5.1-3","1.5.1-3+squeeze1","1.5.1-3+squeeze1~bpo50+1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5+deb7u1"}]}],"versions":["1.6.1-5","1.6.1-5+deb7u1~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:2","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.2.mga2"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.2.mga3"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"xml_security_for_c\\+\\+"}],"references":[{"url":"http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/dsig/DSIGAlgorithmHandlerDefault.cpp?r1=1125752\u0026r2=1493960\u0026pathrev=1493960\u0026diff_format=h","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"http://www.debian.org/security/2013/dsa-2710","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://www.tenable.com/security/tns-2018-15","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://santuario.apache.org/secadv.data/CVE-2013-2155.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0142.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2155"},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-pq9g-7grj-xrm8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2155","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0193.html","tags":["advisory"]},{"url":"http://santuario.apache.org/secadv.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10563","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2155","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T15:27:40.987Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2120","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-pq9g-7grj-xrm8","title":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly...","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2022-05-13T01:05:56Z","modified":"2025-04-11T04:14:04Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-2155","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2013-08-20T22:55:03.817Z","modified":"2026-06-16T23:52:51.013Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-2155","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2013-08-20T22:55:03Z","modified":"2026-04-16T06:25:37.143977851Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2155","description":"Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.","status":"published","published":"2013-08-20T22:55:03.817Z","modified":"2026-09-01T20:03:15.580470623Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2710-1","title":"xml-security-c - several","status":"published","published":"2013-06-18T00:00:00Z","modified":"2026-03-09T01:21:41.988695Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0193","title":"Updated xml-security-c package fixes multiple security vulnerabilities","description":"The implementation of XML digital signatures in the Santuario-C++ library\nis vulnerable to a spoofing issue allowing an attacker to reuse existing\nsignatures with arbitrary content (CVE-2013-2153).\n\nA stack overflow, possibly leading to arbitrary code execution, exists in\nthe processing of malformed XPointer expressions in the XML Signature\nReference processing code (CVE-2013-2154).\n\nA bug in the processing of the output length of an HMAC-based XML\nSignature would cause a denial of service when processing specially chosen\ninput (CVE-2013-2155).\n\nA heap overflow exists in the processing of the PrefixList attribute\noptionally used in conjunction with Exclusive Canonicalization, potentially\nallowing arbitrary code execution (CVE-2013-2156).\n\nThe attempted fix to address CVE-2013-2154 introduced the possibility of a\nheap overflow, possibly leading to arbitrary code execution, in the\nprocessing of malformed XPointer expressions in the XML Signature Reference\nprocessing code (CVE-2013-2210).\n","status":"published","published":"2013-07-01T19:12:07Z","modified":"2026-04-16T06:22:29.190113936Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}