Red Hat Bugzilla – Bug 1470204
CVE-2017-10672 perl-XML-LibXML: Use-after-free by controlling the arguments to a replaceChild call
Last modified: 2017-07-27 04:39:30 EDT
Use-after-free in the XML-LibXML module through 2.0129 for Perl allows attackers to execute arbitrary code by controlling the arguments to a replaceChild call.
Created perl-XML-LibXML tracking bugs for this issue:
Affects: fedora-all [bug 1470205]
Upstream provided a patch that simply short-circuits the case of replacing a child node with the same node to no-operation.
There is an alternative fix provided by the reporter <https://github.com/shlomif/perl-XML-LibXML/pull/8>.
Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.