CVE-2011-4625: Debian Linux

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Simplesamlphp Simplesamlphp: from 1.6.0, before 1.6.3 (fixed in 1.6.3); from 1.8.0, before 1.8.2 (fixed in 1.8.2)

Published 2019-11-06. Last modified 2026-06-16.