{"id":"MGASA-2017-0305","summary":"Updated xmlsec1 packages fix security vulnerability","details":"It was discovered xmlsec1's use of libxml2 inadvertently enabled\nexternal entity expansion (XXE) along with validation. An attacker could\ncraft an XML file that would cause xmlsec1 to try and read local files\nor HTTP/FTP URLs, leading to information disclosure or denial of service\n(CVE-2017-1000061).\n","modified":"2026-04-16T06:25:03.318935357Z","published":"2017-08-24T21:18:23Z","upstream":["CVE-2017-1000061"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2017-0305.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=21586"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:2492"}],"affected":[{"package":{"name":"xmlsec1","ecosystem":"Mageia:5","purl":"pkg:rpm/mageia/xmlsec1?arch=source&distro=mageia-5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1.mga5"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2017-0305.json"}},{"package":{"name":"xmlsec1","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/xmlsec1?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2017-0305.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}