{"schemaVersion":3,"id":"CVE-2018-0486","aliases":["SUSE-SU-2018:0140-1","UBUNTU-CVE-2018-0486","DEBIAN-CVE-2018-0486","DLA-1242-1","DSA-4085-1"],"status":"published","duplicateOf":null,"title":null,"description":"Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.","dates":{"published":"2018-01-13T18:00:00.000Z","modified":"2024-08-05T03:28:11.047Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.4,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Debian","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","exploitability":10,"impact":4.2,"computed":true}]},"epss":{"probability":0.01531,"percentile":0.74392,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01531},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01812,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01531,"percentile":0.74392}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01812,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01531,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01531,"percentile":0.74392}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature","description":"The product does not verify, or incorrectly verifies, the cryptographic signature for data.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/347.html"}],"affected":[{"vendor":"debian","product":"xmltooling","name":"xmltooling","label":"xmltooling","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/xmltooling","purlType":"deb","versions":[{"text":"< 1.6.3-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.3-2+deb8u2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.4.2-5+deb7u2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3-1 | < 1.5.3-2+deb8u2 | < 1.4.2-5+deb7u2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"xmltooling","name":"xmltooling","label":"xmltooling","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/xmltooling","purlType":"deb","versions":[{"text":"< 1.5.3-2+deb8u2build0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.6-2ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.3-2+deb8u2build0.14.04.1 | < 1.5.6-2ubuntu0.1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.0 | 9.0","eol":{"isEol":true,"eolDate":"2018-05-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (Wheezy)","eolFrom":"2018-05-31T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"7.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Server 12 SP2","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Server 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Server 12 SP2","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Server 12 SP3","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Server 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Server 12 SP3","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP2","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"suse","product":"xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","name":"xmltooling","label":"xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/xmltooling&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","purlType":"rpm","versions":[{"text":"< 1.5.6-3.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.6-3.3.2","eol":null,"hubHref":null},{"vendor":"shibboleth","product":"xmltooling-c","name":"xmltooling-c","label":"xmltooling-c","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3","eol":null,"hubHref":"/vendor/shibboleth/xmltooling-c"}],"affectedCount":11,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://www.debian.org/security/2018/dsa-4085","label":"www.debian.org/security/2018/dsa-4085","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2018/msg00007.html","label":"lists.debian.org/debian-security-announce/2018/msg00007.html","hostname":"lists.debian.org","tags":["X Refsource MISC","Mailing List","Third Party Advisory"]},{"url":"https://shibboleth.net/community/advisories/secadv_20180112.txt","label":"shibboleth.net/community/advisories/secadv_20180112.txt","hostname":"shibboleth.net","tags":["X Refsource MISC","Vendor Advisory","REPORT"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html","label":"lists.debian.org/debian-lts-announce/2018/01/msg00016.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040177","label":"www.securitytracker.com/id/1040177","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180140-1/","label":"www.suse.com/support/update/announcement/2018/suse-su-20180140-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1075975","label":"bugzilla.suse.com/1075975","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0486","label":"www.suse.com/security/cve/CVE-2018-0486","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2018-0486","label":"ubuntu.com/security/CVE-2018-0486","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0486","label":"www.cve.org/CVERecord?id=CVE-2018-0486","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-0486","label":"security-tracker.debian.org/tracker/CVE-2018-0486","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:11523-1","SUSE-SU-2018:0720-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:11523-1","SUSE-SU-2018:0720-1"]},"timeline":[{"kind":"published","date":"2018-01-13T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T03:28:11.047Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T21:37:33.360Z","stale":false,"partial":false}}