Bug 1408302 (CVE-2016-9596) - CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery mode (unfixed CVE-2016-3627 in JBCS)
Summary: CVE-2016-9596 libxml2: stack exhaustion while parsing xml files in recovery m...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-9596
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1426171
TreeView+ depends on / blocked
 
Reported: 2016-12-22 20:24 UTC by Bharti Kundal
Modified: 2021-02-04 21:19 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-09-05 05:35:57 UTC
Embargoed:

Attachments (Terms of Use)

Description Bharti Kundal 2016-12-22 20:24:59 UTC 
It was found that Red Hat JBoss Core Services incorrectly fixed CVE-2016-3627 in Apache HTTP 2.4.23 (erratum RHSA-2016:2957), leaving libxml2 vulnerable to a Denial of Service attack via stack consumption.
Comment 2 Salvatore Bonaccorso 2016-12-22 20:45:27 UTC 
Are there any details available for this? Upsteam bug, commit reference?
Comment 4 Tomas Hoger 2017-01-02 10:21:14 UTC 
(In reply to Salvatore Bonaccorso from comment #2)
> Are there any details available for this? Upsteam bug, commit reference?

This and the other two should be for a Red Hat specific security regressions, effectively duplicates of other public CVEs.  I'm going to ask Bharti to fix these bugs up properly.
Comment 7 Marcus Meissner 2017-02-20 10:14:34 UTC 
dup of CVE-2016-3627 I would say
Comment 8 Tomas Hoger 2017-02-23 17:23:11 UTC 
This CVE id is for the same issue as CVE-2016-3627 (bug 1319829).  This additional CVE was assigned because the original issue was listed as fixed in RHSA-2016:2957 for the Red Hat JBoss Core Services:

https://rhn.redhat.com/errata/RHSA-2016-2957.html

However, that erratum actually failed to include the fix for the issue.

Therefore, this new CVE is specific to the Red Hat JBoss Core Services product and is better described as: missing/incorrect fix for CVE-2016-3627 in the Red Hat JBoss Core Services.
Comment 10 Timothy Walsh 2018-09-05 04:14:58 UTC 
JBCS 2.4.29 RHSA-2018:2486 includes rebased libxml2 to 2.9.7 which addresses this CVE and CVE-2016-9597.
Note You need to log in before you can comment on or make changes to this bug.