CVE-2017-12874

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
https://simplesamlphp.org/security/201612-03Patch, Vendor Advisory
https://www.debian.org/security/2018/dsa-4127Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
https://simplesamlphp.org/security/201612-03Patch, Vendor Advisory
https://www.debian.org/security/2018/dsa-4127Third Party Advisory

Timeline

Published: Sep 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-128756.5The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a craft CVE-2017-128766.5Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted fil CVE-2017-128776.5Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial CVE-2017-128795.4Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monitor before 17.3.33.2654 CVE-2017-128818.8Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication CVE-2017-128825.4Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary Jav CVE-2017-128839.1Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attacker CVE-2017-128847.5OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-128856.1OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-12898.2IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e CVE-2017-128927.8Foxit PDF Compressor installers from versions from 7.0.0.183 to 7.7.2.10 contain a DLL preloading vulnerability, wherein it is possible for CVE-2017-128939.8The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len().