ESB-2018.0598 - [Debian] xmltooling: Multiple vulnerabilities 2018-03-01

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0598
                  xmltooling security update for Debian 7
                               1 March 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           xmltooling
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
Impact/Access:     Access Privileged Data         -- Remote/Unauthenticated
                   Provide Misleading Information -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-0489  

Reference:         ESB-2018.0583
                   ESB-2018.0574
                   ESB-2018.0572
                   ESB-2018.0571

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Package : xmltooling
Version : 1.4.2-5+deb7u3
CVE ID : CVE-2018-0489

Kelby Ludwig and Scott Cantor discovered that the Shibboleth service
provider is vulnerable to impersonation attacks and information
disclosure due to incorrect XML parsing. For additional details please
refer to the upstream advisory at
https://shibboleth.net/community/advisories/secadv_20180227.txt

For Debian 7 "Wheezy", these problems have been fixed in version
1.4.2-5+deb7u3.

We recommend that you upgrade your xmltooling packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAlqXOi5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeQvYg/9GqqBXM6DOkyTis2lMLTo25Vny89YCYEiFWNHFo0MKGHmxX3Py1nQaUpr
OqrIT4ciz8nm1ddH/xGZA9OXqI7gRi+fvNVzp0XC0l0M8Z01L9NocCf5F7BsY8YI
WB+tZa2IExp+yqahungYiiGa33D/WcRsOc2oULYxwdzqi4O89eAiyM6c5f+GEl9p
20mqh2dvDPK7zNSF9M+bkMNssi4kaoAXIwuWULEUqRTqhobzE+jGDs93zouMvuBT
/mEvI/kFDNrMaRKXFMHna8o3wGo4X2a20Sv5NVWuJkmG/hruTpCmtQPrQZLKkBra
6onFoMn6l88vMTKL0QFH5wrQZ2Y2fuFFJ9SNJZZqUifWoFDHgF0CdyR2JdylrVOA
jJNyGRhWf3fKyMD6mEZ/3vFLtFY72377ILD3piTvzZVp836jJhknwQvrMNvcsBga
AXaZQx2fgAkJjQA4NmTIOMA6ruancx0xvyXQ4ftoiPlCdkLTIJK/J2irA6Qvaw06
S2kTLId1/ka5JepwxUqoToihGpgoHgDVTolJQg5n1YRJJPbaXdMIX0nzkmQKZnsa
yjqRpTSDpH1ugyNJBj44Ck5W7+rqULdlQRxdFmE4MQlxmckmcEq3CUTCHGjWCIWl
aBQ+RbsCwH27UiGMmrsoWcF5neCCJQACLrro5SIf9xEh6HY2uWY=
=1G7g
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWpejIYx+lLeg9Ub1AQj0OA//a0MNtECh96+gJZMEjXuEqIbG51gCNkyd
Dy8zICKePturi2S6v/nkQN1CKE/TpnMsGohGHmEJekBPVbZyugrZG4oSCjKsKJ+z
PCatyqPOmcCLQsCoc5GjCghilVhHlE+dM3Ov3UJQQrY+IS50L5iRViYuPxCvB1pS
/ulLrhSeCa1CFThhtIFKnVYe/cV3toRrPji6sxkiLDjF/T010V+mdXssVwHRMCLu
dpgikYcx9d4rC5EMhqwpF9FvyROivvlPcK1NZYP32L8cqmpA5tYPAiPCAWoMKDi1
TxEehgL2dR5o6OYg0S+/g2xMojjYwNGpXBdslfTAE8UfOs3G+frHtzex66xexNY7
X0/Dspp6fbsKrG+m8eif4JfpW9DxlYrpIjnOGAmYhiIo88AT2BUVb8JezejZ0oG9
KXGy4/P5aGKb41FNBbVdUN4GiWs7SGL16dLdsIEg6KYb6vsJyKjfkGIwBB8RtkLI
sn0sROkl0bDY2NrLSKC0rVw+N8H4++p1JgmgrV9WXa6evFzGU0CD2JZTKeCvZ95s
b2QVlRlaYm+3GZbuAGB8tQBWfU4Nh33X8eKy6cCuagbC1hdBjFhhzefDljRv3n8i
7YgFpl3lJiOW3kGsuKYUS86xkFJoPirvxKYmUqmPY8Es8aO7/uVuU2FFMkeHfA3M
R7WunKbitBY=
=r5wW
-----END PGP SIGNATURE-----

« Back to bulletins