Bug 1408305 (CVE-2016-9597)
| Summary: | CVE-2016-9597 libxml2: stack overflow before detecting invalid XML file (unfixed CVE-2016-3705 in JBCS) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Bharti Kundal <bkundal> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amaris, carnil, chazlett, csutherl, gmollett, gzaronik, jclere, mbabacek, mbliss, mturk, sardella, security-response-team, tanaya_patil, twalsh, vpakolu |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-09-05 05:46:01 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1426171 | ||
|
Description
Bharti Kundal
2016-12-22 20:34:19 UTC
Are there any details available for this? Upsteam bug, commit reference? (In reply to Salvatore Bonaccorso from comment #2) > Are there any details available for this? Upsteam bug, commit reference? Referring to https://bugzilla.redhat.com/show_bug.cgi?id=1408302#c4 Hi Adam Thanks for the information here and in the related bugs. I guess there is though some confusion around the CVEs. E.g. then SuSE is tracking that CVE for https://bugzilla.novell.com/show_bug.cgi?id=1017497 . Regards, Salvatore > Thanks for the information here and in the related bugs. I guess there is > though some confusion around the CVEs. E.g. then SuSE is tracking that CVE > for https://bugzilla.novell.com/show_bug.cgi?id=1017497 . Thank you for notifying us about that, Salvatore. I put the comment in Suse bugzilla: https://bugzilla.novell.com/show_bug.cgi?id=1017497#c18 This CVE id is for the same issue as CVE-2016-3705 (bug 1332443). This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services: https://rhn.redhat.com/errata/RHSA-2016-2957.html However, that erratum actually failed to include the fix for the issue. Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3705 in the Red Hat JBoss Core Services. Hi, Waiting for a fix on this CVE. As the bug status is still 'NEW', would like to know if we getting the complete fix for this CVE. If yes please share when. Thanks, Tanaya JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9596. Can anyone please specify the version in which this issue is fixed or mention it in the "target milestone" field? (In reply to Tanaya Patil from comment #20) > Can anyone please specify the version in which this issue is fixed or > mention it in the "target milestone" field? It seems the previous comment already answers your question, doesn't it? |