November 2011 - mingw - Fedora Mailing-Lists

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |710397 -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|public=20110720,reported=20 |public=20110720,reported=20 |110721,source=cve,impact=mo |110721,source=cve,impact=lo |derate,cvss2=6.8/AV:N/AC:M/ |w,cvss2=4.3/AV:A/AC:H/Au:N/ |Au:N/C:P/I:P/A:P,fedora-all |C:P/I:P/A:P,fedora-all/libx |/libxml=new,fedora-all/libx |ml=new,fedora-all/libxml2=a |ml2=new,fedora-all/mingw32- |ffected,fedora-all/mingw32- |libxml2=new,rhel-4/libxml2= |libxml2=affected,rhel-4/lib |new,rhel-5/libxml2=new,rhel |xml2=affected,rhel-5/libxml |-6/libxml2=new |2=affected,rhel-6/libxml2=a | |ffected Status Whiteboard|rhel-6/mingw32-libxml2=new |rhel-6/mingw32-libxml2=affe | |cted -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 --- Comment #30 from Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> 2011-11-22 00:08:40 EST --- We have recently discovered new facts about this issue. They suggest that Red Hat Enterprise Linux 4, 5 and 6. As well as Fedora release 14, 15 and 16 are affected by this flaw. -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

Legal approval of the mingw-w64 toolchain?

by Erik van Pienbroek

Hi Fedora Legal, Back in Januari this year we (the Fedora MinGW SIG) filed a review request for various packages belonging to the mingw-w64 cross compiler toolchain. This was done because we want to add support for cross-compiling binaries for the win64 target in Fedora. We made two of these packages (mingw-headers [1] and mingw-crt [2]) block FE-LEGAL as we received some signals in the past that a legal audit should be done for these packages. We are not entirely sure if such a legal audit is really necessary but in order to play it safe we wanted someone from FE-LEGAL/RH-LEGAL to take a look at it. Earlier this year, one of the lead mingw-w64 developers was hired by Red Hat. With this step we (the Fedora MinGW SIG) expected that the legal issues would get sorted out soon, but unfortunately there's still no news. This mingw-w64 developer has tried to contact RH-LEGAL multiple times, but he kept getting the answer from the lawyer that other more important issues got between. As there have already passed about 10 months since the initial request we're getting a bit frustrated with the situation as we still don't know how long this legal approval is going to take. All other preparations for the introduction of the mingw-w64 toolchain are already done. We've updated our packaging guidelines [3] and got them approved by the FPC [4]. We've already ported about 75 mingw32 packages to use these new packaging guidelines [5] and have been testing everything in a separate yum repo [6] for the time being. As you can see we have to maintain the mingw packages in two different places at the moment. Once in the Fedora repos and once in the testing repo. As this is quite a maintenance burden to keep everything in sync we would like to merge all changes from the mingw-w64 testing repo back to the Fedora repos sooner than later. The only thing which is blocking is from going forward right now is the legal approval. We are currently aiming for Fedora 17 to introduce the mingw-w64 toolchain. This means that the legal approval has to be done before the F17 feature submission deadline which is at the end of Januari 2012 [7]. Is there anything we can do to help speed up the legal approval? Kind regards, Erik van Pienbroek Fedora MinGW SIG [1]: https://bugzilla.redhat.com/show_bug.cgi?id=673790 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=673792 [3]: https://fedoraproject.org/wiki/Packaging:MinGW_Future [4]: https://fedorahosted.org/fpc/ticket/71 [5]: http://svn.openftd.org/svn/fedora_cross/ [6]: https://fedoraproject.org/wiki/MinGW/CrossCompilerFramework [7]: http://fedoraproject.org/wiki/Releases/17/Schedule

12 years, 5 months

1
0
0 / 0

Broken dependencies in EPEL - 2011-11-20

by Fedora Koji Build System

Your following packages in the repository suffer from broken dependencies: ====================================================================== The results in this summary consider Test Updates! ====================================================================== package: mingw32-libpng-1.2.37-3.el6.noarch from fedora-epel-6-ppc64 unresolved deps: mingw32(msvcrt.dll) mingw32(zlib1.dll) mingw32(kernel32.dll) mingw32-filesystem >= 0:63 mingw32-runtime

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 --- Comment #26 from Daniel Veillard <veillard(a)redhat.com> 2011-11-18 09:05:22 EST --- urgh that should have been deprecated for ages ... Daniel -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 --- Comment #25 from Paul Howarth <paul(a)city-fan.org> 2011-11-18 04:43:49 EST --- (In reply to comment #24) > In what version of encoding.c did you look ? Because that bug has > been around forever ... if you mean libxml as libxml version1, then yes > it's likely to not have that code, it's more than 10 years old, and I > don't think the support for iconv was plugged yet at the time of renaming > to libxml2. Yes, I did mean libxml as libxml version1; it's still in Fedora at the moment. -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 --- Comment #24 from Daniel Veillard <veillard(a)redhat.com> 2011-11-18 03:34:37 EST --- In what version of encoding.c did you look ? Because that bug has been around forever ... if you mean libxml as libxml version1, then yes it's likely to not have that code, it's more than 10 years old, and I don't think the support for iconv was plugged yet at the time of renaming to libxml2. But any recent version of libxml (i.e. libxml2) is affected. Daniel -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 --- Comment #23 from Paul Howarth <paul(a)city-fan.org> 2011-11-16 13:51:33 EST --- (In reply to comment #21) > Upstream commit: > http://git.gnome.org/browse/libxml2/commit/?id=69f04562f75212bfcabecd190e... I don't see any code like that in libxml's encoding.c so I guess that's not vulnerable? -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to heap-based buffer overflow in encoding

by Red Hat Bugzilla

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=724906 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2011-0216 libxml, |CVE-2011-0216 libxml2: |libxml2, mingw32-libxml2: |Off-by-one error leading to |Off-by-one error leading to |heap-based buffer overflow |heap-based buffer overflow |in encoding |and application crash via a | |crafted web site | --- Comment #21 from Tomas Hoger <thoger(a)redhat.com> 2011-11-16 04:50:12 EST --- Upstream commit: http://git.gnome.org/browse/libxml2/commit/?id=69f04562f75212bfcabecd190e... -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

12 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

mingw November 2011