p PatchFirst

CVE-2017-12874

CVE-2017-12874

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

CVSS 7.5 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • simplesamlphp Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.14.11-1

    Update to 1.14.11-1

  • simplesamlphp Debian:14

    Versions
    • 1.10.0-1
    • 1.11.0-1
    • 1.12.0-1
    • 1.12.0~rc1-1
    • 1.12.0~rc2-1
    • 1.13.0-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.1-1
    • 1.14.10-1
    • 1.14.2-1
    • 1.14.2-2
    • 1.14.3-1
    • 1.14.4-1
    • 1.14.5-1
    • 1.14.6-1
    • 1.14.7-1
    • 1.14.8-1
    • 1.14.9-1
    • 1.6.0-1
    • 1.6.1-1
    • 1.6.2-1
    • 1.6.3-1
    • 1.6.3-2
    • 1.6.3-3
    • 1.7.0-1
    • 1.7.0-2
    • 1.8.0-1
    • 1.8.1-1
    • 1.8.2-1
    • 1.9.0-1
    • 1.9.0~rc1-1
    • 1.9.0~rc2-1
    • 1.9.1-1
    • 1.9.2-1
    Affected ranges
    • ECOSYSTEM: < 1.14.11-1

    Update to 1.14.11-1

  • simplesamlphp/simplesamlphp-module-infocard Packagist

    Versions
    • v1.0
    Affected ranges
    • ECOSYSTEM: < 1.0.1

    Update to 1.0.1

  • simplesamlphp Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.2-1
    • 1.14.0-1
    • 1.14.0-1ubuntu2
    • 1.14.0-1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →