Bug 1716453 (CVE-2016-4607)

Summary:	CVE-2016-4607 libxslt: allows remote attacker to cause denial of service
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, dbecker, dking, eglynn, erik-fedora, igor.raits, jjoyce, jschluet, kbasil, klember, lhh, lpeer, lsvaty, mburns, mgarciac, pgrist, rhos-maint, rjones, sclewis, sisharma, slinaber, ssaha, vbellur, veillard
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libxslt 1.1.29	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-15 14:47:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1716458, 1716459, 1725530
Bug Blocks:	1714985

Description Dhananjay Arunesh 2019-06-03 14:30:38 UTC

libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on
Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before
2.2.2 allows remote attackers to cause a denial of service (memory corruption)
or possibly have unspecified other impact via unknown vectors, a different
vulnerability than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and
CVE-2016-4612.

http://seclists.org/oss-sec/2017/q2/385

Comment 1 Dhananjay Arunesh 2019-06-03 14:35:05 UTC

Created libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1716458]


Created mingw-libxslt tracking bugs for this issue:

Affects: fedora-all [bug 1716459]

Comment 6 Marco Benatto 2019-07-15 14:48:40 UTC

Statement:

Red Hat OpenStack will consume fixes from the base Red Hat Enterprise Linux Operating System. Therefore the package provided by Red Hat OpenStack has been marked as will not fix.

Red Hat Product Security could not determine whether Red Hat Enterprise Linux is affected by this flaw due to lack of information on the flaw. Therefore this issue is being marked as won't fix.