Bug 691939

Summary:	CVE-2009-3720 expat: buffer over-read and crash on XML with malformed UTF-8 sequences [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vincent Danen <vdanen>
Component:	sitecopy	Assignee:	Rakesh Pandit <rpandit>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	14	CC:	dmalcolm, jorton, rpandit
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Release Note
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-03-30 07:24:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	531697

Description Vincent Danen 2011-03-29 22:00:10 UTC

This is an automatically created tracking bug!  It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.

For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.

For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs

When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.

Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=531697

Please note: this issue affects multiple supported versions of Fedora.
Only one tracking bug has been filed; please only close it when all
affected versions are fixed.


[bug automatically created by: add-tracking-bugs]

Comment 1 Joe Orton 2011-03-30 07:24:41 UTC

sitecopy does use the system expat already.

Comment 2 Vincent Danen 2011-03-30 15:46:34 UTC

Ahh, ok, I see it.

./configure calls --with-neon, requiring neon-devel, which in turn requires expat-devel (looked like it was using the internal expat at first quick look due to no buildrequires/mention of expat in the spec).

So the embedded expat is there because there is an embedded neon, which explains why there is no requirements on libexpat in the rpm --requires.

Thanks!  Sorry for the noise.

Comment 3 Dave Malcolm 2011-03-30 15:49:18 UTC

FWIW, is it worth deleting the duplicate sources within the %prep?  (I do this within the python.spec to try to ensure that we can't possibly be using unpatched copies of code).

Comment 4 Joe Orton 2011-03-30 16:00:45 UTC

Good idea, Dave, thanks - done for Raw Hide.