Hide Forgot
IssueDescription: A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.
Created attachment 944444 [details] Proposed upstream patch
Created attachment 946196 [details] Patch for RHEL-7
Created attachment 946225 [details] Patch for RHEL-6
Created attachment 946226 [details] Patch for RHEL-5 This one was actually quite harder to come by, the backport required intimate knowledge of library internals.
Public via: https://git.gnome.org/browse/libxml2/commit/?id=be2a7edaf289c5da74a4f9ed3a0b6c733e775230
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2014:1655 https://rhn.redhat.com/errata/RHSA-2014-1655.html
libxml2-2.9.1-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Just wondering, will the RHEL5 patch hit the repositories soon?
libxml2-2.9.1-6.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2014:1885 https://rhn.redhat.com/errata/RHSA-2014-1885.html
libxml2-2.9.1-2.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.