oss-security - Re: Re: libxml security fix from apple ... any information?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201107290952.42084.thomas@suse.de>
Date: Fri, 29 Jul 2011 09:52:41 +0200
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Cc: Billy Rios <billy.rios@...il.com>
Subject: Re: Re: libxml security fix from apple ... any information?


Hello,
if the code executed is the same on Windows and on Linux I would assume
this affects Linux too. That the bug is not "seen" during fuzzing
means nothing.

Cheers,
Thomas

Am Freitag, 29. Juli 2011, 06:59:22 schrieb Billy Rios:
> The crash was indeed in libxml2, but I could not get the bug to repro in
> Linux.  We took the crash file and fuzzed a bit more on Linux, but no
> crashes were observed.
> 
> BK
> 
> 
> On Thu, Jul 28, 2011 at 6:22 AM, Marcus Meissner <meissner@...e.de> wrote:
> 
> > Hi folks, Billy, Daniel,
> >
> > On
> > http://support.apple.com/kb/HT4808
> > there is a libxml security issue listed:
> >
> > -----------------------------------------
> > libxml
> >
> > Available for: Windows 7, Vista, XP SP2 or later
> >
> > Impact: Visiting a maliciously crafted website may lead to an unexpected
> > application termination or arbitrary code execution
> >
> > Description: A one-byte heap buffer overflow existed in libxml's handling
> > of XML data. Visiting a maliciously crafted website may lead to an
> > unexpected application termination or arbitrary code execution.
> >
> > CVE-ID
> >
> > CVE-2011-0216 : Billy Rios of the Google Security Team
> > -----------------------------------------
> >
> > I suspect this is libxml2 and it likely also affects Linux?
> >
> > If this is correct, could you identify the commit fixing this issue?
> >
> > Ciao, Marcus
> >
> 


-- 
Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg
--
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.