Advisories » MGASA-2014-0558

Updated xml-security packages fix CVE-2013-4517

Publication date: 31 Dec 2014
Modification date: 31 Dec 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2013-4517

Description

Updated xml-security packages fixes security vulnerability:

Apache Santuario XML Security for Java before 1.5.6, when applying
Transforms, allows remote attackers to cause a denial of service (memory
consumption) via crafted Document Type Definitions (DTDs), related to
signatures (CVE-2013-4517).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14485
• https://lists.fedoraproject.org/pipermail/package-announce/2014-November/142709.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4517

SRPMS

4/core

• xml-security-1.5.7-1.mga4