Bug 1220607 (CVE-2015-2716) - CVE-2015-2716 expat: Integer overflow leading to buffer overflow in XML_GetBuffer()
Summary: CVE-2015-2716 expat: Integer overflow leading to buffer overflow in XML_GetBu...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-2716
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1232574 1579625 1831819
Blocks: 1209788
TreeView+ depends on / blocked
 
Reported: 2015-05-12 01:19 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 05:18 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-03-31 22:31:52 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0988 0 normal SHIPPED_LIVE Critical: firefox security update 2015-05-12 22:49:54 UTC
Red Hat Product Errata RHSA-2015:1012 0 normal SHIPPED_LIVE Important: thunderbird security update 2015-05-18 13:03:41 UTC
Red Hat Product Errata RHSA-2020:1011 0 None None None 2020-03-31 19:10:41 UTC
Red Hat Product Errata RHSA-2020:2508 0 None None None 2020-06-10 17:44:37 UTC

Description Huzaifa S. Sidhpurwala 2015-05-12 01:19:04 UTC
Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash.

In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.



External Reference:

http://www.mozilla.org/security/announce/2015/mfsa2015-54.html


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Ucha Gobejishvili as the original reporter.

Comment 1 errata-xmlrpc 2015-05-12 18:50:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5

Via RHSA-2015:0988 https://rhn.redhat.com/errata/RHSA-2015-0988.html

Comment 3 errata-xmlrpc 2015-05-18 09:04:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1012 https://rhn.redhat.com/errata/RHSA-2015-1012.html

Comment 4 Huzaifa S. Sidhpurwala 2015-06-17 05:14:28 UTC
Created expat tracking bugs for this issue:

Affects: fedora-all [bug 1232574]

Comment 5 Huzaifa S. Sidhpurwala 2015-06-17 05:15:50 UTC
The following patch was applied by Mozilla to fix this issue:

https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c

Comment 6 Huzaifa S. Sidhpurwala 2015-06-17 05:18:03 UTC
Statement:

This issue affects the version of expat package as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update may address this flaw.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.

Comment 17 errata-xmlrpc 2020-03-31 19:10:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1011 https://access.redhat.com/errata/RHSA-2020:1011

Comment 18 Product Security DevOps Team 2020-03-31 22:31:52 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2015-2716

Comment 21 errata-xmlrpc 2020-06-10 17:44:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:2508 https://access.redhat.com/errata/RHSA-2020:2508


Note You need to log in before you can comment on or make changes to this bug.