Bug 1421996 (CVE-2017-5969)

Summary:	CVE-2017-5969 libxml2: Null pointer dereference in xmlSaveDoc implementation
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	athmanem, c.david86, erik-fedora, fedora-mingw, ktietz, ohudlick, rjones, sardella, slawomir, veillard, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference was discovered in libxml2, when using xmllint --recover. A maliciously crafted file, when parsed in recovery mode, could cause the application to crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-23 06:02:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1421997, 1421998, 1421999
Bug Blocks:	1422003

Description Andrej Nemec 2017-02-14 09:54:53 UTC

A vulnerability was found in libxml2. A maliciously crafted file could cause the application to crash, due to the xmlSaveDoc functionality not being safe.

References:

https://bugzilla.gnome.org/show_bug.cgi?id=778519
http://seclists.org/oss-sec/2017/q1/415

Comment 1 Andrej Nemec 2017-02-14 09:55:59 UTC

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1421998]


Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1421999]
Affects: fedora-all [bug 1421997]

Comment 2 Doran Moppert 2017-03-23 06:01:06 UTC

Statement:

Recovery mode is not intended for use with untrusted input. Users invoking xmllint --recover may experience a crash, but applications processing documents from possibly malicious sources should not be exposed to this flaw.