Debian Libxml-Security-Java vulnerabilities

CVE-2021-40690 [HIGH] CVE-2021-40690: libxml-security-java - All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.... All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element. Scope: local

CVE-2013-2172 [MEDIUM] CVE-2013-2172: libxml-security-java - jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML... jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

CVE-2013-4517 [MEDIUM] CVE-2013-4517: libxml-security-java - Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, a... Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures. Scope: local bookworm: resolved (fixed in 1.5.6-1) bullseye: resolved (fixed in 1.5.6-1) forky: resolved (fixed in 1.5.6-1) sid: reso

CVE-2019-12400 [MEDIUM] CVE-2019-12400: libxml-security-java - In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was... In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Sa