{
  "schema_version": "1.4.0",
  "id": "GHSA-qm7x-7jjj-7r38",
  "modified": "2025-04-11T04:13:02Z",
  "published": "2022-05-13T01:05:56Z",
  "aliases": [
    "CVE-2013-2156"
  ],
  "details": "Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PrefixList attribute.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2156"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3@%3Ccommits.santuario.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd%40%3Ccommits.santuario.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r1c07a561426ec5579073046ad7f4207cdcef452bb3100abaf908e0cd@%3Ccommits.santuario.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2018-15"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0143.html"
    },
    {
      "type": "WEB",
      "url": "http://santuario.apache.org/secadv.data/CVE-2013-2156.txt"
    },
    {
      "type": "WEB",
      "url": "http://svn.apache.org/viewvc?view=revision&revision=1493961"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2013/dsa-2710"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-08-20T22:55:00Z"
  }
}