« Volver al listado

CVE-2013-2156

Estado: ModificadaAlta (7.5)—

Desbordamiento de búfer basado en memoria dinámica en la funcionalidad Exclusive Canonicalization (xsec/canon/XSECC14n20010315.cpp) en Apache Santuario XML Security para C++ (aka xml-security-c) anterior a 1.7.1 , permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente la ejecución de código arbitrario a través de un atributo PrefixList modificado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — XML Security FOR C++

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-2156",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-20T22:55:03.847",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0143.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://santuario.apache.org/secadv.data/CVE-2013-2156.txt",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1493961",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2710",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.tenable.com/security/tns-2018-15",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0143.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://santuario.apache.org/secadv.data/CVE-2013-2156.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1493961",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2710",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/tns-2018-15",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PrefixList attribute."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en memoria dinámica en la funcionalidad Exclusive Canonicalization  (xsec/canon/XSECC14n20010315.cpp) en Apache Santuario XML Security para C++ (aka xml-security-c) anterior a  1.7.1 , permite a atacantes remotos provocar una denegación de servicio (caída) y posiblemente la ejecución de código arbitrario a través de un atributo PrefixList modificado."
    }
  ],
  "lastModified": "2026-06-16T23:52:51.147",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6E08B80-1BD6-4EC2-93DF-AEAA536EDE0F",
              "versionEndIncluding": "1.7.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFD5684C-5B70-4CD3-89E7-0F3097958AAA"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED43C71F-52EF-4689-B318-58F61A851BA3"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEDB2652-EAAB-43B6-B696-3F959BA8FF44"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D49CBC6A-9D55-4DD0-B8DE-EA180ECDC65E"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9261A27B-0AAE-4E04-B86A-6580A5AF2338"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52CA39D1-4388-4D32-9731-A77A398AC7CF"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "121C098C-89AF-4BC2-976B-A4D6A67834DD"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C786580-77FE-4E7E-AA2E-39B976CD8C01"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BAC98AB-3D00-43C3-9DF1-39857DFD3A2A"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C316AD-4D17-4286-9A63-300D04CD276B"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D0DC1ED-A147-44FA-9A4D-364B98921C35"
            },
            {
              "criteria": "cpe:2.3:a:apache:xml_security_for_c\\+\\+:1.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B2CEC20-1F70-4D95-8972-3163720BCC20"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}