An use-after-free flaw was found in the libxml component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=623378 External References: https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2016:1485 https://rhn.redhat.com/errata/RHSA-2016-1485.html
Detailed analysis and explanation available in the upstream bug (currently closed) at: https://bugzilla.gnome.org/show_bug.cgi?id=768428 Chromium used the following patch to fix this issue (not upstream yet): https://codereview.chromium.org/2127493002
Created libxml2 tracking bugs for this issue: Affects: fedora-all [bug 1361439]
Created mingw-libxml2 tracking bugs for this issue: Affects: fedora-all [bug 1364322] Affects: epel-7 [bug 1364323]
This issue seems to be in libxml, not just chromium. Is libxml planned to be updated?
Upstream patch (libxml2): https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e
Statement: This flaw in libxml2 requires exposing the library to XPath/XPointer expressions from an untrusted source, which is not common in practice for applications using libxml2. For libxml2, Red Hat Product Security has rated this vulnerability as Moderate severity.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1190 https://access.redhat.com/errata/RHSA-2020:1190