Bug 1358641 (CVE-2016-5131) - CVE-2016-5131 libxml2: use after free triggered by XPointer paths beginning with range-to
Summary: CVE-2016-5131 libxml2: use after free triggered by XPointer paths beginning w...
Alias: CVE-2016-5131
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1364323 1695415 1714050 1358710 1358711 1361439 1364322 1525811
Blocks: 1358650 1384433
TreeView+ depends on / blocked
Reported: 2016-07-21 08:03 UTC by Adam Mariš
Modified: 2019-09-29 13:53 UTC (History)
16 users (show)

Fixed In Version: Chrome 52.0.2743.82, libxml2 2.9.5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-02-26 05:01:14 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1485 normal SHIPPED_LIVE Important: chromium-browser security update 2016-07-26 09:18:37 UTC

Description Adam Mariš 2016-07-21 08:03:06 UTC
An use-after-free flaw was found in the libxml component of the Chromium browser.

Upstream bug(s):


External References:


Comment 2 errata-xmlrpc 2016-07-26 05:19:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2016:1485 https://rhn.redhat.com/errata/RHSA-2016-1485.html

Comment 3 Huzaifa S. Sidhpurwala 2016-07-29 05:43:16 UTC
Detailed analysis and explanation available in the upstream bug (currently closed) at:


Chromium used the following patch to fix this issue (not upstream yet):


Comment 4 Huzaifa S. Sidhpurwala 2016-07-29 05:43:54 UTC
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1361439]

Comment 5 Huzaifa S. Sidhpurwala 2016-08-05 05:31:43 UTC
Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1364322]
Affects: epel-7 [bug 1364323]

Comment 6 dafox7777777 2016-11-02 15:09:20 UTC
This issue seems to be in libxml, not just chromium. Is libxml planned to be updated?

Comment 7 Doran Moppert 2017-03-23 06:09:28 UTC
Upstream patch (libxml2):


Comment 12 Doran Moppert 2019-05-20 02:03:45 UTC

This flaw in libxml2 requires exposing the library to XPath/XPointer expressions from an untrusted source, which is not common in practice for applications using libxml2.  For libxml2, Red Hat Product Security has rated this vulnerability as Moderate severity.

Note You need to log in before you can comment on or make changes to this bug.