CVE-2009-3476

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/36869Vendor Advisory
http://secunia.com/advisories/36870Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090826.txtVendor Advisory
http://www.securityfocus.com/bid/36514
https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
http://secunia.com/advisories/36869Vendor Advisory
http://secunia.com/advisories/36870Vendor Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090826.txtVendor Advisory
http://www.securityfocus.com/bid/36514
https://exchange.xforce.ibmcloud.com/vulnerabilities/53471

Timeline

Published: Sep 29, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-34776.8The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 befor CVE-2009-34786.0Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP E CVE-2009-34794.3Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows re CVE-2009-34807.5SQL injection vulnerability in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! allows remote attackers to execute arbitrary SQ CVE-2009-34817.5A certain interface in the iCRM Basic (com_icrmbasic) component 1.4.2.31 for Joomla! does not require administrative authentication, which h CVE-2009-34827.8TrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGR CVE-2009-34839.3Heap-based buffer overflow in the Create New Site feature in GlobalSCAPE CuteFTP Professional, Home, and Lite 8.3.3 and 8.3.3.0054 allows us CVE-2009-34849.3Stack-based buffer overflow in Core FTP 2.1 build 1612 allows user-assisted remote attackers to execute arbitrary code via a long hostname i CVE-2009-34854.3Cross-site scripting (XSS) vulnerability in the J-Web interface in Juniper JUNOS 8.5R1.14 and 9.0R1.1 allows remote attackers to inject arbi CVE-2009-34863.5Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inj CVE-2009-34873.5Multiple cross-site scripting (XSS) vulnerabilities in the J-Web interface in Juniper JUNOS 8.5R1.14 allow remote authenticated users to inj CVE-2009-34882.1Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with