<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for xmltooling</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2019:0929-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2019-04-10T14:35:39Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2019-04-10T14:35:39Z</InitialReleaseDate>
    <CurrentReleaseDate>2019-04-10T14:35:39Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xmltooling</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for xmltooling fixes the following issues:
	  
Security issue fixed: 	  

- CVE-2019-9628: Fixed an improper handling of exception in XMLTooling library which could result in
denial of service against the application using XMLTooling (bsc#1129537).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2019-929,SUSE-SLE-Module-Server-Applications-15-2019-929</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20190929-1/</URL>
      <Description>Link for SUSE-SU-2019:0929-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2019-April/005323.html</URL>
      <Description>E-Mail link for SUSE-SU-2019:0929-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1129537</URL>
      <Description>SUSE Bug 1129537</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-9628/</URL>
      <Description>SUSE CVE CVE-2019-9628 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Server Applications 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Server Applications 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15" CPE="cpe:/o:suse:sle-module-server-applications:15">SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libxmltooling-devel-1.6.4-3.3.2">
      <FullProductName ProductID="libxmltooling-devel-1.6.4-3.3.2">libxmltooling-devel-1.6.4-3.3.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libxmltooling7-1.6.4-3.3.2">
      <FullProductName ProductID="libxmltooling7-1.6.4-3.3.2">libxmltooling7-1.6.4-3.3.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xmltooling-schemas-1.6.4-3.3.2">
      <FullProductName ProductID="xmltooling-schemas-1.6.4-3.3.2">xmltooling-schemas-1.6.4-3.3.2</FullProductName>
    </Branch>
    <Relationship ProductReference="libxmltooling-devel-1.6.4-3.3.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:libxmltooling-devel-1.6.4-3.3.2">libxmltooling-devel-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libxmltooling7-1.6.4-3.3.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:libxmltooling7-1.6.4-3.3.2">libxmltooling7-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="xmltooling-schemas-1.6.4-3.3.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15:xmltooling-schemas-1.6.4-3.3.2">xmltooling-schemas-1.6.4-3.3.2 as a component of SUSE Linux Enterprise Module for Server Applications 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.</Note>
    </Notes>
    <CVE>CVE-2019-9628</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:libxmltooling-devel-1.6.4-3.3.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:libxmltooling7-1.6.4-3.3.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15:xmltooling-schemas-1.6.4-3.3.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2019/suse-su-20190929-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-9628.html</URL>
        <Description>CVE-2019-9628</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1129537</URL>
        <Description>SUSE Bug 1129537</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
