Bug 1408306 (CVE-2016-9598) - CVE-2016-9598 libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)
Summary: CVE-2016-9598 libxml2: out-of-bounds read (unfixed CVE-2016-4483 in JBCS)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-9598
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1426171
TreeView+ depends on / blocked
 
Reported: 2016-12-22 20:40 UTC by Bharti Kundal
Modified: 2020-12-15 15:21 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:04:53 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2486 0 None None None 2018-08-16 16:08:17 UTC

Description Bharti Kundal 2016-12-22 20:40:22 UTC 
libxml2: out-of-bounds read
Comment 2 Salvatore Bonaccorso 2016-12-22 20:44:38 UTC 
Are there any details available for this? Upsteam bug, commit reference?
Comment 3 Adam Mariš 2017-01-03 11:03:21 UTC 
(In reply to Salvatore Bonaccorso from comment #2)
> Are there any details available for this? Upsteam bug, commit reference?

Referring to https://bugzilla.redhat.com/show_bug.cgi?id=1408302#c4
Comment 4 Adam Mariš 2017-01-12 10:10:28 UTC 
CVE-2016-9598 was assigned for incomplete fix of CVE-2016-4483, however that was closed as duplicate of CVE-2016-3627. That actually makes this CVE a duplicate of CVE-2016-9596 since that one was assigned for incomplete fix of CVE-2016-3627.

Hence I suggest to close this one as duplicate of CVE-2016-9596. Would that work for you?
Comment 8 Tomas Hoger 2017-02-23 17:27:23 UTC 
This CVE id is for the same issue as CVE-2016-4483  (bug 1332820).  This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services:

https://rhn.redhat.com/errata/RHSA-2016-2957.html

However, that erratum actually failed to include the fix for the issue.

Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-4483  in the Red Hat JBoss Core Services.
Comment 9 errata-xmlrpc 2018-08-16 16:08:11 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2018:2486 https://access.redhat.com/errata/RHSA-2018:2486
Note You need to log in before you can comment on or make changes to this bug.