Bug 1408302 – CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1408302 - (CVE-2016-9596) CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)

Summary:	CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery m...

Status:	CLOSED ERRATA

Aliases:	CVE-2016-9596

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160321,repor...
Keywords:	Security

Depends On:
Blocks:	1426171
	Show dependency tree / graph

Reported:	2016-12-22 15:24 EST by Bharti Kundal
Modified:	2018-09-05 01:35 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-09-05 01:35:57 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Bharti Kundal 2016-12-22 15:24:59 EST

libxml2: stack exhaustion while parsing xml files in recovery mode

Comment 2 Salvatore Bonaccorso 2016-12-22 15:45:27 EST

Are there any details available for this? Upsteam bug, commit reference?

Comment 4 Tomas Hoger 2017-01-02 05:21:14 EST

(In reply to Salvatore Bonaccorso from comment #2)
> Are there any details available for this? Upsteam bug, commit reference?

This and the other two should be for a Red Hat specific security regressions, effectively duplicates of other public CVEs.  I'm going to ask Bharti to fix these bugs up properly.

Comment 7 Marcus Meissner 2017-02-20 05:14:34 EST

dup of CVE-2016-3627 I would say

Comment 8 Tomas Hoger 2017-02-23 12:23:11 EST

This CVE id is for the same issue as CVE-2016-3627 (bug 1319829).  This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services:

https://rhn.redhat.com/errata/RHSA-2016-2957.html

However, that erratum actually failed to include the fix for the issue.

Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3627 in the Red Hat JBoss Core Services.

Comment 10 Timothy Walsh 2018-09-05 00:14:58 EDT

JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9597.

Note You need to log in before you can comment on or make changes to this bug.