Debian Security Advisory

DLA-259-1 shibboleth-sp2 -- LTS security update

Date Reported:
30 Jun 2015
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2015-2684.
More information:

A denial of service vulnerability was found in the Shibboleth (an federated identity framework) Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash.

For the Debian 6 Squeeze distribution, this problem has been fixed in version 2.3.1+dfsg-5+deb6u1.

We recommend that you upgrade your shibboleth-sp2 packages.