[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAM4uigfMzY+ZZA2_CXMvzv9wT8hD6pk-mSHv_pcZPTbqE5Sp+w@mail.gmail.com>
Date: Thu, 28 Jul 2011 21:59:22 -0700
From: Billy Rios <billy.rios@...il.com>
To: Marcus Meissner <meissner@...e.de>
Cc: OSS Security List <oss-security@...ts.openwall.com>, veillard@...hat.com
Subject: Re: libxml security fix from apple ... any information?
The crash was indeed in libxml2, but I could not get the bug to repro in
Linux. We took the crash file and fuzzed a bit more on Linux, but no
crashes were observed.
BK
On Thu, Jul 28, 2011 at 6:22 AM, Marcus Meissner <meissner@...e.de> wrote:
> Hi folks, Billy, Daniel,
>
> On
> http://support.apple.com/kb/HT4808
> there is a libxml security issue listed:
>
> -----------------------------------------
> libxml
>
> Available for: Windows 7, Vista, XP SP2 or later
>
> Impact: Visiting a maliciously crafted website may lead to an unexpected
> application termination or arbitrary code execution
>
> Description: A one-byte heap buffer overflow existed in libxml's handling
> of XML data. Visiting a maliciously crafted website may lead to an
> unexpected application termination or arbitrary code execution.
>
> CVE-ID
>
> CVE-2011-0216 : Billy Rios of the Google Security Team
> -----------------------------------------
>
> I suspect this is libxml2 and it likely also affects Linux?
>
> If this is correct, could you identify the commit fixing this issue?
>
> Ciao, Marcus
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
