-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3065-1 security@xxxxxxxxxx http://www.debian.org/security/ Sebastien Delafond November 06, 2014 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxml-security-java CVE ID : CVE-2013-2172 Debian Bug : 720375 James Forshaw discovered that, in Apache Santuario XML Security for Java, CanonicalizationMethod parameters were incorrectly validated: by specifying an arbitrary weak canonicalization algorithm, an attacker could spoof XML signatures. For the stable distribution (wheezy), this problem has been fixed in version 1.4.5-1+deb7u1. For the testing distribution (jessie), this problem has been fixed in version 1.5.5-2. For the unstable distribution (sid), this problem has been fixed in version 1.5.5-2. We recommend that you upgrade your libxml-security-java packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJUWzQGAAoJEAVMuPMTQ89Ec7QP/2SKxUIAhRFzJklrdoT1XV0N XX7XfHIinIFdTo6TTcPFWRGlByo35NL/c14gBrUgJOIWsvyPdxZVF3vJQVBvHXes 88jFJQnZyaloM1KSLG3PqrG/TUoyMQmLf7fyBiNyHR2WyBzLQXvWTSMt7TObxZSq qTf5D5U1etEP4V1vbmlm5IZmmwb21aOmpD5tVEu9Yt2JFLe22Q4HuX6GF8vD7yU8 6MLqaDjc6lQEIMliIvHl3dH1QoahRht7jkMfQxr9n2UxPtsqaWOxmqKtQjeMs6YB pHItKQcfqcVYTc1Xz8iUzBFkP20rTNeucmxzdxy0XUBFU6HluHwfoiGsb3BYJzWA 7DVT9V5jY7dHqd6n4olNYUf0JLrHinuTCyqhkdcEO0TWf4elDKLWfAdDkqC74Erl VXaVMYm7wITP4xn92DNYACYOvEWg6xo7NSODQcuV+bemXpi8Bs/b0MrQWSPxH/KN dIsqTSvaR8nZ+bEevWwIJ+fDa+Zq8p/G7ey/zAulyqSn9XIRQNHBZgj8mh3yuvbb AIv/prJLyofQXrNdyOjbNpVz+E+kwglqK3bbPCCxPZ/iY0YJLdfbSF5HDxT5sobF 9BGsEmhVhZ2XYHjPTvKd2Oexzk/wFPGmseD1UWDHmh9ZNkpdkGgw8IdXSFIrOqxA hZ1TIIrTPs4FwLl3b18M =TYcp -----END PGP SIGNATURE-----
