{"id":"CVE-2018-0486","aliases":["DEBIAN-CVE-2018-0486","DLA-1242-1","DSA-4085-1","EUVD-2018-1309","GHSA-34v3-mf7p-7v76","SUSE-SU-2018:0140-1","SUSE-SU-2018:0720-1","UBUNTU-CVE-2018-0486","openSUSE-SU-2024:11523-1"],"status":"published","title":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on...","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01531,"percentile":0.74924,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2018-01-12T00:00:00Z","modified":"2026-10-23T18:03:17Z","fixes":[{"ecosystem":"Debian:12","package":"xmltooling","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmltooling","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmltooling","fixed_in":["1.6.3-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"xmltooling","fixed_in":["1.4.2-5+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"xmltooling","fixed_in":["1.5.3-2+deb8u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xmltooling","fixed_in":["1.5.3-2+deb8u2build0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xmltooling","fixed_in":["1.5.6-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-5+deb7u2"}]}],"versions":["1.4.2-5","1.4.2-5+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2+deb8u2"}]}],"versions":["1.5.3-2","1.5.3-2+deb8u1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2+deb8u2build0.14.04.1"}]}],"versions":["1.5.3-2","1.5.3-2+deb8u1build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-2ubuntu0.1"}]}],"versions":["1.5.3-2.1ubuntu2","1.5.6-1","1.5.6-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.2"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"shibboleth","product":"xmltooling-c"}],"references":[{"url":"https://www.debian.org/security/2018/dsa-4085","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2018/msg00007.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://shibboleth.net/community/advisories/secadv_20180112.txt","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1040177","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0486"},{"url":"https://github.com/advisories/GHSA-34v3-mf7p-7v76"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-0486","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1075975","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0486","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180720-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0489","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-0486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0486","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9628","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:00:00Z","modified":"2024-08-05T03:28:11.047Z","updated_at":"2026-11-02T14:35:12.596526Z"}],"euvd":[{"id":"EUVD-2018-1309","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:00:00Z","modified":"2024-08-05T03:28:11Z","updated_at":"2026-11-03T02:40:18.31448Z"}],"ghsa":[{"id":"GHSA-34v3-mf7p-7v76","title":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on...","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2022-05-14T03:44:30Z","modified":"2023-02-02T05:08:30Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:52:45.271372Z"}],"nvd":[{"id":"CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:29:00.207Z","modified":"2026-06-17T01:30:56.31Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:22.309028Z"}],"osv":[{"id":"CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:29:00.207Z","modified":"2026-03-15T22:25:08.114808Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:29:00.207Z","modified":"2026-10-23T18:03:17.219728012Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-0486","description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","status":"published","published":"2018-01-13T18:29:00Z","modified":"2026-04-22T11:38:18.095371Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1242-1","title":"xmltooling - security update","status":"published","published":"2018-01-14T00:00:00Z","modified":"2026-03-09T01:01:44.754565Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4085-1","title":"xmltooling - security update","status":"published","published":"2018-01-12T00:00:00Z","modified":"2026-03-09T01:22:55.539759Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"openSUSE-SU-2024:11523-1","title":"libxmltooling-devel-3.2.0-1.2 on GA media","description":"These are all security issues fixed in the libxmltooling-devel-3.2.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:01.707039Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0140-1","title":"Security update for xmltooling","description":"This update for xmltooling fixes the following issues:\n\n- CVE-2018-0486: Fixed a security bug when xmltooling mishandles digital\n  signatures of user attribute data, which allows remote attackers to obtain\n  sensitive information or conduct impersonation attacks via a crafted DTD\n  (bsc#1075975)\n","status":"published","published":"2018-01-19T12:38:12Z","modified":"2026-02-04T04:22:59.16855Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0720-1","title":"Security update for xmltooling","description":"This update for xmltooling fixes the following issues:\n\n- CVE-2018-0489: Fixed a security bug when xmltooling mishandled digital\n  signatures of user data, which allows remote attackers to obtain\n  sensitive information or conduct impersonation attacks via crafted\n  XML data. NOTE: this issue exists because of an incomplete fix for\n  CVE-2018-0486. (bsc#1083247)\n","status":"published","published":"2018-03-16T15:31:26Z","modified":"2026-02-04T02:41:19.538506Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}