Bug 1421996 – CVE-2017-5969 libxml2: Null pointer dereference in xmlSaveDoc implementation

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1421996 - (CVE-2017-5969) CVE-2017-5969 libxml2: Null pointer dereference in xmlSaveDoc implementation

Summary:	CVE-2017-5969 libxml2: Null pointer dereference in xmlSaveDoc implementation

Status:	CLOSED WONTFIX

Aliases:	CVE-2017-5969

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20161105,reported=2...
Keywords:	Security

Depends On:	1421999 1421997 1421998
Blocks:	1422003
	Show dependency tree / graph

Reported:	2017-02-14 04:54 EST by Andrej Nemec
Modified:	2017-03-23 11:43 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference was discovered in libxml2, when using xmllint --recover. A maliciously crafted file, when parsed in recovery mode, could cause the application to crash.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-03-23 02:02:17 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2017-02-14 04:54:53 EST

A vulnerability was found in libxml2. A maliciously crafted file could cause the application to crash, due to the xmlSaveDoc functionality not being safe.

References:

https://bugzilla.gnome.org/show_bug.cgi?id=778519
http://seclists.org/oss-sec/2017/q1/415

Comment 1 Andrej Nemec 2017-02-14 04:55:59 EST

Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1421998]


Created mingw-libxml2 tracking bugs for this issue:

Affects: epel-7 [bug 1421999]
Affects: fedora-all [bug 1421997]

Comment 2 Doran Moppert 2017-03-23 02:01:06 EDT

Statement:

Recovery mode is not intended for use with untrusted input. Users invoking xmllint --recover may experience a crash, but applications processing documents from possibly malicious sources should not be exposed to this flaw.

Note You need to log in before you can comment on or make changes to this bug.