CVE-2019-9628

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-755

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
https://usn.ubuntu.com/3921-1/Third Party Advisory
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00079.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00095.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/xmltooling/+bug/1819912Issue Tracking, Third Party Advisory
https://security.netapp.com/advisory/ntap-20190611-0003/Third Party Advisory
https://shibboleth.net/community/advisories/secadv_20190311.txtThird Party Advisory
https://usn.ubuntu.com/3921-1/Third Party Advisory
https://wiki.shibboleth.net/confluence/display/SP3/SecurityAdvisoriesThird Party Advisory

Timeline

Published: Apr 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96299.8Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).CVE-2019-96307.5Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository fil CVE-2019-96319.8Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function.CVE-2019-96327.5ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack CVE-2019-96336.5gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting e CVE-2019-96347.8Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.CVE-2019-96356.5NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.CVE-2019-96369.8Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NF CVE-2019-96377.5An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is imp CVE-2019-96387.5An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized r CVE-2019-96397.5An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized r CVE-2019-96407.5An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in