Are there any details available for this? Upsteam bug, commit reference?

(In reply to Salvatore Bonaccorso from comment #2)
>  Are there any details available for this? Upsteam bug, commit reference?

Referring to https://bugzilla.redhat.com/show_bug.cgi?id=1408302#c4

Hi Adam

Thanks for the information here and in the related bugs. I guess there is though some confusion around the CVEs. E.g. then SuSE is tracking that CVE for https://bugzilla.novell.com/show_bug.cgi?id=1017497 .

Regards,
Salvatore

> Thanks for the information here and in the related bugs. I guess there is
> though some confusion around the CVEs. E.g. then SuSE is tracking that CVE
> for https://bugzilla.novell.com/show_bug.cgi?id=1017497 .

Thank you for notifying us about that, Salvatore. I put the comment in Suse bugzilla:

https://bugzilla.novell.com/show_bug.cgi?id=1017497#c18

This CVE id is for the same issue as CVE-2016-3705 (bug 1332443).  This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services:

https://rhn.redhat.com/errata/RHSA-2016-2957.html

However, that erratum actually failed to include the fix for the issue.

Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3705 in the Red Hat JBoss Core Services.

Hi,

Waiting for a fix on this CVE. As the bug status is still 'NEW', would like to know if we getting the complete fix for this CVE. If yes please share when.

Thanks,
Tanaya

JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9596.