High DLA-3981-1 2 CVEs

simplesamlphp - security update

Published Dec 2, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	simplesamlphp	1.19.0-1+deb11u1

Vulnerabilities 2

High 8.8

CVE-2024-52596

SimpleSAMLphp xml-common XXE vulnerability

SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.

simplesamlphp xml-common simplesamlphp simplesamlphp Debian Ubuntu Packagist

Dec 2, 2024
High 8.3

CVE-2024-52806 Public exploit

SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

simplesamlphp saml2 simplesamlphp simplesamlphp Debian Ubuntu Packagist

Dec 2, 2024