CVE-2013-2153

EPSS 0.83%

xml-security-c - several

Published: 8/20/2013Modified: 3/9/2026

Also known as:DSA-2710-1DEBIAN-CVE-2013-2153

Description

The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."

Affected packages (2)

Debian/xml-security-cfrom 0, < 1.6.1-6
Debian/xml-security-cfrom 0, < 1.5.1-3+squeeze2

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2013-2153