Bug 709747 (CVE-2011-1944)

Summary:	CVE-2011-1944 libxml, libxml2: Heap-based buffer overflow by adding new namespace node to an existing nodeset or merging nodesets
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bressers, ohudlick, paul, veillard
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libxml2 2.8.0	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-18 20:11:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	709750, 709751, 710393, 710394, 710395, 710396, 710397, 771906, 771907, 820846, 833934, 891477, 891478
Bug Blocks:	711277, 734217, 734221, 771915, 891480

Description Jan Lieskovsky 2011-06-01 14:46:56 UTC

An integer overflow, leading to heap-based buffer overflow was found
in the way libxml, XML files manipulation library, processed certain
XPath expressions. A remote attacker could provide a specially-crafted
XML file, which once opened in an application linked against libxml
would cause that application to crash, or, potentially, execute arbitrary
code with the privileges of the user running the application.

References:
[1] http://scarybeastsecurity.blogspot.com/2011/05/libxml-vulnerability-and-interesting.html
[2] http://www.openwall.com/lists/oss-security/2011/05/31/5
[3] http://www.openwall.com/lists/oss-security/2011/05/31/8

Upstream patch:
[4] http://git.gnome.org/browse/libxml2/commit/?id=d7958b21e7f8c447a26bb2436f08402b2c308be4

Comment 1 Jan Lieskovsky 2011-06-01 14:49:28 UTC

This issue affects the versions of the libxml2 package, as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the libxml and libxml2 package,
as shipped with Fedora release of 13, 14 and 15. Please schedule
an update.

Comment 2 Jan Lieskovsky 2011-06-01 14:52:21 UTC

Created libxml2 tracking bugs for this issue

Affects: fedora-all [bug 709750]

Comment 3 Jan Lieskovsky 2011-06-01 14:52:24 UTC

Created libxml tracking bugs for this issue

Affects: fedora-all [bug 709751]

Comment 4 Jan Lieskovsky 2011-06-01 14:53:41 UTC

(In reply to comment #3)
> Created libxml tracking bugs for this issue
> 
> Affects: fedora-all [bug 709751]

Note: In libxml F-* package, the relevant affected function is (a/xpath.c):

386 /**
387  * xmlXPathNodeSetAdd:
388  * @cur:  the initial node set
389  * @val:  a new xmlNodePtr
390  *
391  * add a new xmlNodePtr ot an existing NodeSet
392  */
393 void
394 xmlXPathNodeSetAdd(xmlNodeSetPtr cur, xmlNodePtr val) {

The rest functions from the patch are not present there.

Comment 7 Huzaifa S. Sidhpurwala 2011-06-03 10:11:31 UTC

Created libxml2 tracking bugs for this issue

Affects: fedora-all [bug 709750]

Comment 8 Huzaifa S. Sidhpurwala 2011-06-03 10:11:34 UTC

Created libxml tracking bugs for this issue

Affects: fedora-all [bug 709751]

Comment 13 errata-xmlrpc 2011-12-06 18:55:24 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1749 https://rhn.redhat.com/errata/RHSA-2011-1749.html

Comment 16 errata-xmlrpc 2012-01-11 17:49:48 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0017 https://rhn.redhat.com/errata/RHSA-2012-0017.html

Comment 17 Vincent Danen 2012-01-11 19:24:56 UTC

Statement:

(none)

Comment 22 errata-xmlrpc 2013-01-31 19:32:48 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0217 https://rhn.redhat.com/errata/RHSA-2013-0217.html