An use-after-free flaw was found in the libxml component of the Chromium browser.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2016:1485 https://rhn.redhat.com/errata/RHSA-2016-1485.html
Detailed analysis and explanation available in the upstream bug (currently closed) at:
Chromium used the following patch to fix this issue (not upstream yet):
Created libxml2 tracking bugs for this issue:
Affects: fedora-all [bug 1361439]
Created mingw-libxml2 tracking bugs for this issue:
Affects: fedora-all [bug 1364322]
Affects: epel-7 [bug 1364323]
This issue seems to be in libxml, not just chromium. Is libxml planned to be updated?
Upstream patch (libxml2):
This flaw in libxml2 requires exposing the library to XPath/XPointer expressions from an untrusted source, which is not common in practice for applications using libxml2. For libxml2, Red Hat Product Security has rated this vulnerability as Moderate severity.