[Bug 1277146] New: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

List overview All Threads
Download

newer

older

[Bug 1281930] New: libxml2:...

[Bug 1276297] New: CVE-2015-7942...

Red Hat Bugzilla

2 Nov 2015 2 Nov '15

1:45 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Bug ID: 1277146 Summary: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: athmanem@gmail.com, c.david86@gmail.com, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, ktietz@redhat.com, lfarkas@lfarkas.org, ohudlick@redhat.com, rjones@redhat.com, veillard@redhat.com

A vulnerability in libxml2 when parsing specially crafted XML document if XZ support is enabled causing DoS of application was found.

CVE request (including reproducer):

http://seclists.org/oss-sec/2015/q4/206

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5GhAg1MnGX&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

2 Nov 2 Nov

1:46 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Adam Mariš amaris@redhat.com changed:

--- Comment #1 from Adam Mariš amaris@redhat.com ---

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1277147]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1277147 [Bug 1277147] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1277149 [Bug 1277149] mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1277150 [Bug 1277150] mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [epel-7]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=002I6vKEdk&a=cc_unsubscribe

Red Hat Bugzilla

1:46 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Comment #2 from Adam Mariš amaris@redhat.com ---

Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1277149] Affects: epel-7 [bug 1277150]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AMYeZ6iQwJ&a=cc_unsubscribe

Red Hat Bugzilla

1:47 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1277152

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NJfQi6GXgC&a=cc_unsubscribe

Red Hat Bugzilla

2:14 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zKYreGMeJQ&a=cc_unsubscribe

Red Hat Bugzilla

2:16 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Comment #3 from Martin Prpic mprpic@redhat.com --- Statement:

This issue did not affect the versions of libxml2 as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for LZMA compression support.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Gp5AhSdw2r&a=cc_unsubscribe

Red Hat Bugzilla

2:58 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Comment #4 from Martin Prpic mprpic@redhat.com --- LZMA compression support was introduced in libxml2 in:

2.8.0: May 23 2012 Features: add lzma compression support (Anders F Bjorklund)

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=miUAmabA6x&a=cc_unsubscribe

Red Hat Bugzilla

4:45 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Daniel Veillard veillard@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED

--- Comment #5 from Daniel Veillard veillard@redhat.com --- So lzma support in 2.9.2 seems to be broken that's why Fedora seems not affected.

But the bug is present since all version 2.8.0 onward. Seems I managed to get a first fix for the issue, I will add as attachment

Daniel

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bNxLxIST9Y&a=cc_unsubscribe

Red Hat Bugzilla

4:46 p.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Comment #6 from Daniel Veillard veillard@redhat.com --- Created attachment 1088640 --> https://bugzilla.redhat.com/attachment.cgi?id=1088640&action=edit Suggested patch for the issue

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=N1Dr4z2bSr&a=cc_unsubscribe

Red Hat Bugzilla

3 Nov 3 Nov

4:51 a.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146 Bug 1277146 depends on bug 1277147, which changed state.

Bug 1277147 Summary: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1277147

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=r62G5Po1Hk&a=cc_unsubscribe

Red Hat Bugzilla

7:52 a.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Daniel Veillard veillard@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |POST

--- Comment #9 from Daniel Veillard veillard@redhat.com --- https://bugzilla.gnome.org/show_bug.cgi?id=757466

patch pushed upstream:

https://git.gnome.org/browse/libxml2/commit/?id=f0709e3ca8f8947f2d91ed34e92e...

Daniel

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lApr1jP1P0&a=cc_unsubscribe

Red Hat Bugzilla

8:20 a.m.

New subject: [Bug 1277146] libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2015-8035

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=TTDBV4hL59&a=cc_unsubscribe

Red Hat Bugzilla

8:20 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gIXiLaYoMC&a=cc_unsubscribe

Red Hat Bugzilla

24 Nov 24 Nov

9:02 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1274223

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=3D2xvZ6x55&a=cc_unsubscribe

Red Hat Bugzilla

26 Jan 26 Jan

9:52 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|POST |NEW

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

17 Feb 17 Feb

3:56 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146 Bug 1277146 depends on bug 1277149, which changed state.

Bug 1277149 Summary: CVE-2015-8035 mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1277149

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

24 Feb 24 Feb

5:58 p.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146 Bug 1277146 depends on bug 1277150, which changed state.

Bug 1277150 Summary: CVE-2015-8035 mingw-libxml2: libxml2: DoS when parsing specially crafted XML document if XZ support is enabled [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1277150

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

31 Mar 31 Mar

2:14 p.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Timothy Walsh twalsh@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

2:32 p.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

Timothy Walsh twalsh@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1322872

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

18 Apr 18 Apr

12:16 p.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Doc Text *updated* by Timothy Walsh twalsh@redhat.com --- A vulnerability in libxml2 was found that caused a Dos when parsing specially crafted XML document with XZ support is enabled.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

22 Apr 22 Apr

7:05 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Doc Text *updated* by Timothy Walsh twalsh@redhat.com --- A vulnerability in libxml2 was found that caused a denial of service when parsing specially crafted XML document with XZ support is enabled.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6 May 6 May

10:24 a.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

17 May 17 May

5:14 p.m.

New subject: [Bug 1277146] CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

https://bugzilla.redhat.com/show_bug.cgi?id=1277146

--- Comment #13 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html

-- You are receiving this mail because: You are on the CC list for the bug.

3039

Age (days ago)

3236

Last active (days ago)

mingw@lists.fedoraproject.org

22 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla