Bug 978988 (CVE-2013-2210)

Summary: CVE-2013-2210 xml-security-c: Heap-buffer overflow during XPointer evaluation
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: antti.andreimann, bruno
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 11:00:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 978990, 978991    
Bug Blocks:    

Description Jan Lieskovsky 2013-06-27 12:40:40 UTC 
A heap-based buffer overflow flaw was found in the way xml-security-c, a C++ implementation of the XML Digital Signature specification, used to evaluate certain XPointer expressions. The fix to address CVE-2013-2154 flaw introduced a possibility of a heap-based buffer overflow, in the processing of malformed XPointer expression in the XML Signature References processing code. A remote attacker could provide a specially-crafted XML file to an application linked against xml-security-c that, when processed would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application.

References:
[1] http://santuario.apache.org/secadv.data/CVE-2013-2210.txt

Relevant upstream patch:
[2] http://svn.apache.org/viewvc?view=revision&revision=r1496703
Comment 1 Jan Lieskovsky 2013-06-27 12:46:32 UTC 
Created xml-security-c tracking bugs for this issue:

Affects: fedora-all [bug 978990]
Affects: epel-all [bug 978991]
Comment 2 Product Security DevOps Team 2019-06-10 11:00:52 UTC 
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.