Ubuntu update for xmlsec1



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-1000061
CWE-ID CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Ubuntu
Operating systems & Components / Operating system

xmlsec1 (Ubuntu package)
Operating systems & Components / Operating system package or component

libxmlsec1 (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper input validation

EUVDB-ID: #VU52581

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-1000061

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to read data or crash the application.

The vulnerability exists due to improper input validation within the XML Messaging (xmlSec) component in PeopleSoft Enterprise PeopleTools. A local non-authenticated attacker can exploit this vulnerability to read data or crash the application.

Mitigation

Update the affected package xmlsec1 to the latest version.

Vulnerable software versions

Ubuntu: 16.04

xmlsec1 (Ubuntu package): before Ubuntu Pro (Infra-only)

libxmlsec1 (Ubuntu package): before Ubuntu Pro (Infra-only)

CPE2.3 External links

https://ubuntu.com/security/notices/USN-5674-1


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###