Security Advisory: CVE-2011-2516

From: Cantor, Scott E. <>
To: <>
Cc: <>, <>, <>
Subject: Security Advisory: CVE-2011-2516

Please be advised that a security issue affecting the Apache XML Security
Library for C++ has been identified and an updated version released to
address the issue. The full text of the advisory is below, and a signed
version can be found at:

-- Scott Cantor

CVE-2011-2516: Apache Santuario XML Security for C++ contains buffer
overflows signing or verifying with large keys.

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: Apache Santuario XML Security for C++ library versions
prior to V1.6.1

Description: A buffer overflow exists when creating or verifying XML
with RSA keys of sizes on the order of 8192 or more bits. This typically
in a crash and denial of service in applications that verify signatures
keys that could be supplied by an attacker.

Mitigation: Applications using library versions older than V1.6.1 should
as soon as possible. Distributors of older versions should apply the
from this subversion revision:

Applications that can prevent the use of arbitrary keys supplied by an
(such as within the ds:KeyInfo element of a signature), or limit key
sizes, may
prevent the exploitation of this bug.

Credit: This issue was reported by Paulo Zanoni.


Scott Cantor

Copyright © 1995-2020 All rights reserved.