Date: Fri, 3 Oct 2008 09:16:16 +0200 From: Daniel Veillard <veillard@...hat.com> To: Robert Buchholz <rbu@...too.org> Cc: oss-security@...ts.openwall.com Subject: Re: libxml2 "ampproblem" DoS On Thu, Oct 02, 2008 at 06:41:18PM +0200, Robert Buchholz wrote: > Hey, > > I did not look into this issue closely yet, but I can reproduce an OOM > situation on libxml2 2.7.1, but not on 2.6.32. > > The malicious XML file can be found on > http://bugzilla.gnome.org/show_bug.cgi?id=554660 > > I'm not sure if and how this is related to CVE-2008-3281. It's unrelated, the patch is attached to the bug, only 2.7.x is affected and I will release 2.7.2 within a couple of hours. Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@...llard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ