Security update for xmltooling SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0929-1 Final 1 1 2019-04-10T14:35:39Z current 2019-04-10T14:35:39Z 2019-04-10T14:35:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xmltooling This update for xmltooling fixes the following issues: Security issue fixed: - CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in denial of service against the application using XMLTooling (bsc#1129537). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-929,SUSE-SLE-Module-Server-Applications-15-2019-929 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190929-1/ Link for SUSE-SU-2019:0929-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005323.html E-Mail link for SUSE-SU-2019:0929-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1129537 SUSE Bug 1129537 https://www.suse.com/security/cve/CVE-2019-9628/ SUSE CVE CVE-2019-9628 page SUSE Linux Enterprise Module for Server Applications 15 libxmltooling-devel-1.6.4-3.3.2 libxmltooling7-1.6.4-3.3.2 xmltooling-schemas-1.6.4-3.3.2 libxmltooling-devel-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 libxmltooling7-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 xmltooling-schemas-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type. CVE-2019-9628 SUSE Linux Enterprise Module for Server Applications 15:libxmltooling-devel-1.6.4-3.3.2 SUSE Linux Enterprise Module for Server Applications 15:libxmltooling7-1.6.4-3.3.2 SUSE Linux Enterprise Module for Server Applications 15:xmltooling-schemas-1.6.4-3.3.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190929-1/ https://www.suse.com/security/cve/CVE-2019-9628.html CVE-2019-9628 https://bugzilla.suse.com/1129537 SUSE Bug 1129537