Bug 1408302 (CVE-2016-9596)

Summary:	CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)
Product:	[Other] Security Response	Reporter:	Bharti Kundal <bkundal>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	brian, carnil, chazlett, csutherl, dmoppert, gzaronik, jclere, mbabacek, meissner, mturk, sardella, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-05 05:35:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1426171

Description Bharti Kundal 2016-12-22 20:24:59 UTC

It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.

Comment 2 Salvatore Bonaccorso 2016-12-22 20:45:27 UTC

Are there any details available for this? Upsteam bug, commit reference?

Comment 4 Tomas Hoger 2017-01-02 10:21:14 UTC

(In reply to Salvatore Bonaccorso from comment #2)
> Are there any details available for this? Upsteam bug, commit reference?

This and the other two should be for a Red Hat specific security regressions, effectively duplicates of other public CVEs.  I'm going to ask Bharti to fix these bugs up properly.

Comment 7 Marcus Meissner 2017-02-20 10:14:34 UTC

dup of CVE-2016-3627 I would say

Comment 8 Tomas Hoger 2017-02-23 17:23:11 UTC

This CVE id is for the same issue as CVE-2016-3627 (bug 1319829).  This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services:

https://rhn.redhat.com/errata/RHSA-2016-2957.html

However, that erratum actually failed to include the fix for the issue.

Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3627 in the Red Hat JBoss Core Services.

Comment 10 Timothy Walsh 2018-09-05 04:14:58 UTC

JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9597.