{"id":"CVE-2019-9628","aliases":["DEBIAN-CVE-2019-9628","DLA-1710-1","DSA-4407-1","EUVD-2022-2804","GHSA-6hvf-xvwm-vrw4","SUSE-SU-2019:0928-1","SUSE-SU-2019:0929-1","UBUNTU-CVE-2019-9628","USN-3921-1","openSUSE-SU-2019:1235-1","openSUSE-SU-2024:11523-1"],"status":"published","title":"XMLTooling Library Incorrectly Handles Some Exceptions","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02052,"percentile":0.81388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2019-03-12T00:00:00Z","modified":"2026-09-21T07:03:26Z","fixes":[{"ecosystem":"Debian:12","package":"xmltooling","fixed_in":["3.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmltooling","fixed_in":["3.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmltooling","fixed_in":["3.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"xmltooling","fixed_in":["1.5.3-2+deb8u4"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"xmltooling","fixed_in":["1.6.0-4+deb9u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xmltooling","fixed_in":["1.5.6-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"xmltooling","fixed_in":["1.6.4-3.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xmltooling","fixed_in":["1.5.3-2+deb8u3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xmltooling","fixed_in":["1.5.6-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"xmltooling","fixed_in":["1.6.4-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"xmltooling","fixed_in":["1.6.4-lp150.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2+deb8u4"}]}],"versions":["1.5.3-2","1.5.3-2+deb8u1","1.5.3-2+deb8u2","1.5.3-2+deb8u3"]},{"source":"osv","ecosystem":"Debian:9","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-4+deb9u2"}]}],"versions":["1.6.0-4","1.6.0-4+deb9u1","1.6.0-4+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2+deb8u3ubuntu0.1"}]}],"versions":["1.5.3-2","1.5.3-2+deb8u1build0.14.04.1","1.5.3-2+deb8u2build0.14.04.1","1.5.3-2+deb8u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-2ubuntu0.3"}]}],"versions":["1.5.3-2.1ubuntu2","1.5.6-1","1.5.6-2","1.5.6-2ubuntu0.1","1.5.6-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1ubuntu2.1"}]}],"versions":["1.6.0-5","1.6.0-5build1","1.6.2-1","1.6.3-1","1.6.4-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-2+deb8u3ubuntu0.1"}]}],"versions":["1.5.3-2","1.5.3-2+deb8u1build0.14.04.1","1.5.3-2+deb8u2build0.14.04.1","1.5.3-2+deb8u3build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.6-2ubuntu0.3"}]}],"versions":["1.5.3-2.1ubuntu2","1.5.6-1","1.5.6-2","1.5.6-2ubuntu0.1","1.5.6-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1ubuntu2.1"}]}],"versions":["1.6.0-5","1.6.0-5build1","1.6.2-1","1.6.3-1","1.6.4-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xmltooling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.2"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"xmltooling_project","product":"xmltooling"}],"references":[{"url":"https://shibboleth.net/community/advisories/secadv_20190311.txt","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://usn.ubuntu.com/3921-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisories","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190611-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9628","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6hvf-xvwm-vrw4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9628","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190611-0003","tags":["web"]},{"url":"https://usn.ubuntu.com/3921-1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190928-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1129537","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9628","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190929-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9628","tags":["report"]},{"url":"https://issues.shibboleth.net/jira/browse/CPPXT-143","tags":["report"]},{"url":"https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commit;h=af27c422f551e16989ff6f1722d83614c8550eb5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3921-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9628","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O7N5AKYN2B3HGTOARHBSRNN6OFMMTUGE/#O7N5AKYN2B3HGTOARHBSRNN6OFMMTUGE","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0489","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-9628","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-04-11T19:26:11Z","modified":"2024-08-04T21:54:44.999Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2022-2804","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-04-11T19:26:11Z","modified":"2024-08-04T21:54:44Z","updated_at":"2026-11-03T03:06:38.242317Z"}],"ghsa":[{"id":"GHSA-6hvf-xvwm-vrw4","title":"XMLTooling Library Incorrectly Handles Some Exceptions","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"withdrawn","published":"2022-05-13T01:02:16Z","modified":"2023-08-01T18:26:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2019-9628","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-04-11T20:29:00.837Z","modified":"2026-06-17T02:44:04.163Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"CVE-2019-9628","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-04-11T20:29:00.837Z","modified":"2026-03-15T21:56:53.710003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9628","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-04-11T20:29:00.837Z","modified":"2026-09-21T07:03:26.71967642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"GHSA-6hvf-xvwm-vrw4","title":"XMLTooling Library Incorrectly Handles Some Exceptions","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"withdrawn","published":"2022-05-13T01:02:16Z","modified":"2026-09-10T03:49:31.255922093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2019-9628","description":"The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.","status":"published","published":"2019-03-12T00:00:00Z","modified":"2026-04-22T12:24:01.27316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1710-1","title":"xmltooling - security update","status":"published","published":"2019-03-13T00:00:00Z","modified":"2026-03-09T01:21:59.835223Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4407-1","title":"xmltooling - security update","status":"published","published":"2019-03-12T00:00:00Z","modified":"2026-03-09T02:09:08.594034Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:1235-1","title":"Security update for xmltooling","description":"This update for xmltooling fixes the following issues:\n\t  \nSecurity issue fixed: \t  \n\n- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in\ndenial of service against the application using XMLTooling (bsc#1129537).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-18T13:03:11Z","modified":"2026-02-04T04:01:03.590596Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11523-1","title":"libxmltooling-devel-3.2.0-1.2 on GA media","description":"These are all security issues fixed in the libxmltooling-devel-3.2.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:01.707039Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0928-1","title":"Security update for xmltooling","description":"This update for xmltooling fixes the following issue:\n\nSecurity issue fixed: \t  \n\n- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in\ndenial of service against the application using XMLTooling (bsc#1129537).\n","status":"published","published":"2019-04-10T14:35:17Z","modified":"2026-02-04T03:42:46.608463Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0929-1","title":"Security update for xmltooling","description":"This update for xmltooling fixes the following issues:\n\t  \nSecurity issue fixed: \t  \n\n- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in\ndenial of service against the application using XMLTooling (bsc#1129537).\n","status":"published","published":"2019-04-10T14:35:39Z","modified":"2026-02-04T03:58:21.494712Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3921-1","title":"xmltooling vulnerability","description":"It was discovered that XMLTooling incorrectly handled certain XML files with\ninvalid data. An attacker could use this issue to cause XMLTooling to crash,\nresulting in a denial of service.\n","status":"published","published":"2019-03-26T12:29:38Z","modified":"2026-04-22T09:54:51.504062Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}