Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

Salvatore Bonaccorso writes: > On Thu, Sep 24, 2015 at 08:54:08AM +0200, Ferenc Wagner wrote: > >> Salvatore Bonaccorso writes: >> >>> Any news for the fix to unstable for CVE-2015-0851? >> >> Sorry, I got bogged down in another department. It isn't

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

Hi, On Thu, Sep 24, 2015 at 08:54:08AM +0200, Ferenc Wagner wrote: > Salvatore Bonaccorso writes: > > > Any news for the fix to unstable for CVE-2015-0851? > > Sorry, I got bogged down in another department. It isn't forgotten, > though, I expect to tend to it in a couple

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

Salvatore Bonaccorso writes: > Any news for the fix to unstable for CVE-2015-0851? Sorry, I got bogged down in another department. It isn't forgotten, though, I expect to tend to it in a couple of days. -- Regards, Feri.

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

Hi Any news for the fix to unstable for CVE-2015-0851? Regards, Salvatore

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

Source: xmltooling Version: 1.3.3-2 Severity: serious Tags: security patch upstream Shibboleth Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

We're already working on this with the Security Team. I wonder if I should prepare new packages (for {wheezy,jessie}-security) with the changelogs closing this bug. Or should it be closed by the unstable upload of 1.5.5? The proposed security uploads can be found at

Bug#793855: DoS, Shibboleth SP software crashes on well-formed but invalid XML (CVE-2015-0851)

On Tuesday 28 July 2015 12:15:43 Ferenc Wagner wrote: We're already working on this with the Security Team. I wonder if I should prepare new packages (for {wheezy,jessie}-security) with the changelogs closing this bug. Or should it be closed by the unstable upload of 1.5.5? The proposed