Red Hat Bugzilla – Bug 787915
xml: xmltex hash table collisions CPU usage DoS
Last modified: 2015-07-24 04:07:48 EDT
Juraj Somorovsky reported that certain XML parsers/servers are affected by the
same, or similar, flaw as the hash table collisions CPU usage denial of
service. Sending a specially crafted message to an XML service can result in
longer processing time, which could lead to a denial of service. It is
reported that this attack on XML can be applied on different XML nodes (such as
entities, element attributes, namespaces, various elements in the XML security,
xmltex is written in TeX. xmltex appears to use the "group" array(ish) type to
store XML elements however it is unclear if this is vulnerable, it needs
passivetex-1.25-11 uses xmltex
As a side note here, both - passivetex and xmltex packages are almost dead packages. No upstream, no future releases expected and now many upstream applications previously dependent on them started to use different things. Even the docbook stylesheets upstream plans to remove extra hacks for passivetex, so it is likely these packages will fade away soon.
I'm wontfixing this. This issue never really got confirmed, and even if it is confirmed, it's impact does not justify fixing.