xml-security-c 1.7.1-1 source package in Debian

Changelog

xml-security-c (1.7.1-1) experimental; urgency=high


  * New upstream release.
    - Fix a spoofing vulnerability that allows an attacker to reuse
      existing signatures with arbitrary content.  (CVE-2013-2153)
    - Fix a stack overflow in the processing of malformed XPointer
      expressions in the XML Signature Reference processing code.
      (CVE-2013-2154)
    - Fix processing of the output length of an HMAC-based XML Signature
      that could cause a denial of service when processing specially
      chosen input.  (CVE-2013-2155)
    - Fix a heap overflow in the processing of the PrefixList attribute
      optionally used in conjunction with Exclusive Canonicalization,
      potentially allowing arbitrary code execution. (CVE-2013-2156)
    - Reduce entity expansion limits when parsing.
    - New --id option to the xenc-checksig utility.
  * Rename the binaries in the xml-security-c-utils package to start with
    xsec-* instead of xmlsec-*.  This reflects the common abbreviation
    used by the package.

 -- Russ Allbery <email address hidden>  Mon, 17 Jun 2013 21:27:58 -0700