Bug 1956522 (CVE-2021-3537) - CVE-2021-3537 libxml2: NULL pointer dereference when post-validating mix content parsed in recovery mode
Summary: CVE-2021-3537 libxml2: NULL pointer dereference when post-validating mix cont...
Keywords:
Status: NEW
Alias: CVE-2021-3537
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1956525 1956528 (view as bug list)
Depends On: 1956523 1957282 1957283 1957284 1957285 1956524
Blocks: 1956531 1957460
TreeView+ depends on / blocked
 
Reported: 2021-05-03 20:32 UTC by Pedro Sampaio
Modified: 2021-05-13 15:55 UTC (History)
20 users (show)

Fixed In Version: libxml2 2.9.11
Doc Type: If docs needed, set a value
Doc Text:
It was found libxml2 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Pedro Sampaio 2021-05-03 20:32:55 UTC
Parsing specially crafted Mixed Content while parsing XML data may lead to invalid data structure being created, as errors were not propagated. This could lead to several NULL Pointer Dereference when post-validating documents parsed in recovery mode. 



References:

https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
https://gitlab.gnome.org/GNOME/libxml2/-/issues/244
https://gitlab.gnome.org/GNOME/libxml2/-/issues/245

Upstream fix:

https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61

Comment 1 Pedro Sampaio 2021-05-03 20:33:33 UTC
Created libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1956524]


Created mingw-libxml2 tracking bugs for this issue:

Affects: fedora-all [bug 1956523]

Comment 3 Cedric Buissart 2021-05-05 11:23:34 UTC
*** Bug 1956525 has been marked as a duplicate of this bug. ***

Comment 4 Cedric Buissart 2021-05-05 11:24:00 UTC
*** Bug 1956528 has been marked as a duplicate of this bug. ***

Comment 6 Cedric Buissart 2021-05-05 14:21:20 UTC
Acknowledgments:

Name: yuawn (NSLab NTU Taiwan)

Comment 9 Cedric Buissart 2021-05-06 07:54:36 UTC
Statement:

For the flaw to be exploitable, the document must be parsed in recovery mode and postvalidated (e.g.: when used in the `xmlling` tool, both `-recover` and `-postvalid` options must be used for the flaw to be exploitable)


Note You need to log in before you can comment on or make changes to this bug.