{"id":"CVE-2013-2210","aliases":["DEBIAN-CVE-2013-2210","DSA-2717-1","EUVD-2013-2164","GHSA-3gh6-67w4-wv53","MGASA-2013-0193"],"status":"published","title":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML...","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06018,"percentile":0.93391,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-06-28T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"xml-security-c","fixed_in":["1.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xml-security-c","fixed_in":["1.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xml-security-c","fixed_in":["1.6.1-7"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"xml-security-c","fixed_in":["1.5.1-3+squeeze3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"xml-security-c","fixed_in":["1.6.1-5+deb7u2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-7"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-3+squeeze3"}]}],"versions":["1.5.1-3","1.5.1-3+squeeze1","1.5.1-3+squeeze1~bpo50+1","1.5.1-3+squeeze2"]},{"source":"osv","ecosystem":"Debian:7","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5+deb7u2"}]}],"versions":["1.6.1-5","1.6.1-5+deb7u1","1.6.1-5+deb7u1~bpo60+1","1.6.1-5+deb7u2~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:2","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1.2.mga2"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"xml-security-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.2.mga3"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"xml_security_for_c\\+\\+"}],"references":[{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0216.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://santuario.apache.org/secadv.data/CVE-2013-2210.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2018-15","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2717","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2210"},{"url":"https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-3gh6-67w4-wv53"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2210","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0193.html","tags":["advisory"]},{"url":"http://santuario.apache.org/secadv.html","tags":["web"]},{"url":"http://www.debian.org/security/2013/dsa-2710","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10563","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2210","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T15:27:41.137Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2164","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-3gh6-67w4-wv53","title":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML...","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2022-05-13T01:05:56Z","modified":"2023-02-13T06:32:05Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:06.501947Z"}],"nvd":[{"id":"CVE-2013-2210","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2013-08-20T22:55:04.12Z","modified":"2026-06-16T23:52:57.137Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-2210","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2013-08-20T22:55:04Z","modified":"2026-04-16T06:26:25.237415909Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2210","description":"Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.","status":"published","published":"2013-08-20T22:55:04.12Z","modified":"2026-09-01T20:03:15.687559868Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2717-1","title":"xml-security-c - heap overflow","status":"published","published":"2013-06-28T00:00:00Z","modified":"2026-03-09T01:22:17.756197Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0193","title":"Updated xml-security-c package fixes multiple security vulnerabilities","description":"The implementation of XML digital signatures in the Santuario-C++ library\nis vulnerable to a spoofing issue allowing an attacker to reuse existing\nsignatures with arbitrary content (CVE-2013-2153).\n\nA stack overflow, possibly leading to arbitrary code execution, exists in\nthe processing of malformed XPointer expressions in the XML Signature\nReference processing code (CVE-2013-2154).\n\nA bug in the processing of the output length of an HMAC-based XML\nSignature would cause a denial of service when processing specially chosen\ninput (CVE-2013-2155).\n\nA heap overflow exists in the processing of the PrefixList attribute\noptionally used in conjunction with Exclusive Canonicalization, potentially\nallowing arbitrary code execution (CVE-2013-2156).\n\nThe attempted fix to address CVE-2013-2154 introduced the possibility of a\nheap overflow, possibly leading to arbitrary code execution, in the\nprocessing of malformed XPointer expressions in the XML Signature Reference\nprocessing code (CVE-2013-2210).\n","status":"published","published":"2013-07-01T19:12:07Z","modified":"2026-04-16T06:22:29.190113936Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}