[Bug 1213957] New: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

List overview All Threads
Download

newer

older

[Bug 1274222] New: libxml2:...

[Bug 1335683] New: [Patch] Fix...

Red Hat Bugzilla

21 Apr 2015 21 Apr '15

4:46 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Bug ID: 1213957 Summary: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: athmanem@gmail.com, c.david86@gmail.com, drizt@land.ru, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, ktietz@redhat.com, lfarkas@lfarkas.org, ohudlick@redhat.com, rjones@redhat.com, veillard@redhat.com

Following issue was reported in libxml2 (http://seclists.org/oss-sec/2015/q2/214):

""" This is an out-of-bounds memory access in libxml2. By entering a unclosed html comment such as <!-- the libxml2 parser didn't stop parsing at the end of the buffer, causing random memory to be included in the parsed comment that was returned to ruby. In Shopify, this caused ruby objects from previous http requests to be disclosed in the rendered page.

Link to the issue in libxml2's bugtracker: https://bugzilla.gnome.org/show_bug.cgi?id=746048

A patched version of nokogiri (which uses a embedded libxml2) is available here: https://github.com/Shopify/nokogiri/compare/1b1fcad8bd64ab70256666c38d2c998e...

This bug is still not patched upstream, but both libxml2 and nokogiri developers are aware of the issue. """

No upstream patches exist at the time of creating this Bugzilla.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zRmasjF3dU&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

21 Apr 21 Apr

4:47 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Vasyl Kaigorodov vkaigoro@redhat.com changed:

--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1213958]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1213958 [Bug 1213958] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1213959 [Bug 1213959] mingw-libxml2: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1213960 [Bug 1213960] mingw-libxml2: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [epel-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5mm9UQIVkj&a=cc_unsubscribe

Red Hat Bugzilla

4:47 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---

Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1213959] Affects: epel-all [bug 1213960]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HLzKlrO8kb&a=cc_unsubscribe

Red Hat Bugzilla

22 Apr 22 Apr

10:55 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Vasyl Kaigorodov vkaigoro@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1214246

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=q7vjWDFpMV&a=cc_unsubscribe

Red Hat Bugzilla

28 Apr 28 Apr

2:14 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

MinGW Maintenance Account fedora-mingw@lists.fedoraproject.org changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1aMCcqZKOQ&a=cc_unsubscribe

Red Hat Bugzilla

4:06 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=9LHcq15ASk&a=cc_unsubscribe

Red Hat Bugzilla

4:49 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ui4bg0QyXV&a=cc_unsubscribe

Red Hat Bugzilla

4:53 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Doc Text *updated* by Stefan Cornelius scorneli@redhat.com --- It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. When processing specially crafted XML content, this could lead to e.g. the disclosure of heap memory contents.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NbKKSLuBi3&a=cc_unsubscribe

Red Hat Bugzilla

29 Apr 29 Apr

8:18 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bOtaT7ysFs&a=cc_unsubscribe

Red Hat Bugzilla

29 Jul 29 Jul

10:46 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Vincent Danen vdanen@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo+ |

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=fMksmINPaC&a=cc_unsubscribe

Red Hat Bugzilla

13 Nov 13 Nov

4:19 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |amaris@redhat.com

--- Comment #5 from Adam Mariš amaris@redhat.com --- Upstream patch:

https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=v9D47zqSsf&a=cc_unsubscribe

Red Hat Bugzilla

4:19 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1262850, 1276694

--- Comment #6 from Adam Mariš amaris@redhat.com --- *** Bug 1262849 has been marked as a duplicate of this bug. ***

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LEtr5yAuta&a=cc_unsubscribe

Red Hat Bugzilla

24 Nov 24 Nov

9 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1274223

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nPDhGxXajN&a=cc_unsubscribe

Red Hat Bugzilla

9:15 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1284794

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=SZlHtEWnAD&a=cc_unsubscribe

Red Hat Bugzilla

30 Nov 30 Nov

3:20 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FZI4D8JwQc&a=cc_unsubscribe

Red Hat Bugzilla

8:02 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Daniel Veillard veillard@redhat.com changed:

--- Comment #10 from Daniel Veillard veillard@redhat.com --- The upstream patch for this is

https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846...

Daniel

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ahAsNRk8jy&a=cc_unsubscribe

Red Hat Bugzilla

2 Dec 2 Dec

1:49 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Martin Cermak mcermak@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |mcermak@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=f9IcC02jSX&a=cc_unsubscribe

Red Hat Bugzilla

7:28 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957 Bug 1213957 depends on bug 1213958, which changed state.

Bug 1213958 Summary: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1213958

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=iu1Ls33QKt&a=cc_unsubscribe

Red Hat Bugzilla

7:29 p.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957 Bug 1213957 depends on bug 1213959, which changed state.

Bug 1213959 Summary: mingw-libxml2: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1213959

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=O3CF8dEsSu&a=cc_unsubscribe

Red Hat Bugzilla

7 Dec 7 Dec

10:13 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6

Via RHSA-2015:2549 https://rhn.redhat.com/errata/RHSA-2015-2549.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dtMFQxnaei&a=cc_unsubscribe

Red Hat Bugzilla

noon

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2015:2550 https://rhn.redhat.com/errata/RHSA-2015-2550.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vtLkKgrzan&a=cc_unsubscribe

Red Hat Bugzilla

8 Dec 8 Dec

6:19 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=YgdsjrwfVG&a=cc_unsubscribe

Red Hat Bugzilla

9 Dec 9 Dec

8:53 a.m.

New subject: [Bug 1213957] libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=joRM3p7s3E&a=cc_unsubscribe

Red Hat Bugzilla

4 Jan 4 Jan

2:40 p.m.

New subject: [Bug 1213957] CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Adam Mariš amaris@redhat.com changed:

--- Comment #13 from Adam Mariš amaris@redhat.com --- CVE assignment:

http://seclists.org/oss-sec/2015/q4/616

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IvzJbXKSLt&a=cc_unsubscribe

Red Hat Bugzilla

24 Feb 24 Feb

5:59 p.m.

New subject: [Bug 1213957] CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957 Bug 1213957 depends on bug 1213960, which changed state.

Bug 1213960 Summary: mingw-libxml2: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1213960

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

31 Mar 31 Mar

2:23 p.m.

New subject: [Bug 1213957] CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Timothy Walsh twalsh@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1 Apr 1 Apr

5:09 a.m.

New subject: [Bug 1213957] CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

Timothy Walsh twalsh@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1323038

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

17 May 17 May

5:13 p.m.

New subject: [Bug 1213957] CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

https://bugzilla.redhat.com/show_bug.cgi?id=1213957

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Via RHSA-2016:1089 https://rhn.redhat.com/errata/RHSA-2016-1089.html

-- You are receiving this mail because: You are on the CC list for the bug.

3036

Age (days ago)

3428

Last active (days ago)

mingw@lists.fedoraproject.org

27 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla