oss-security - Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <517054AB.9080102@redhat.com>
Date: Thu, 18 Apr 2013 14:16:43 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Agostino Sarubbo <ago@...too.org>, veillard@...hat.com
Subject: Re: CVE request : libxml2 Multiple Use-After-Free
 Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/17/2013 06:45 AM, Agostino Sarubbo wrote:
> From the secunia advisory SA53061[1]:
> 
> 1) An use-after-free error in "htmlParseChunk()" can be exploited
> to dereference already freed memory.

Please use CVE-2013-1969 for this issue.

> 2) Two use-after-free errors in "xmldecl_done()" can be exploited
> to dereference already freed memory.

Please use CVE-2013-1970 for this issue.

> The vulnerabilities are reported in version 2.9.0. Other versions
> may also be affected.
> 
> Commit: 
> https://git.gnome.org/browse/libxml2/commit/?id=de0cc20c29cb3f056062925395e0f68d2250a46f
>
>  [1]: https://secunia.com/advisories/53061/

Thanks

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRcFSrAAoJEBYNRVNeJnmT7FIQAILwU3b8RiSi+4dxRfhBR7cy
CxTLquS7ORT6LJFmcZlMki+1hgOPIrHItM4Mh6xTQZFQaGkkxS4x/zP6G+4iIN6O
h4jtGu913B9EfSS55r5t8gZ4KtfyJHYyS+Rwoo9UiFLqTXKtB/6kU1t2wK/wCGOh
8WMTtCt+6NMUu3l7v30buzdng2AzDLiAT+vdYTNH6hDvqeiJZDzfvI1qejxWsCvl
ACGN4gJi3EqHqVdu29nRZ2YXp1ov4FAjvomY6oT2gN3VKSSDZ9arb+S6QIKztLUA
9AecGgsguiq29Yp76MFpy4kCfXwx32cs2Hl/pG3fRDMmpYVVjoNv2exV11hRYSAs
ogRFDbZeYMUAXCbX361vCuIDN7YoVg5E+0sGg0BGWVmRnfcKN8hcuSLozP/Q66qC
YMvqqDzKZhdbjrIVVyHGL+zRdTDVAf789rr+oM027XBtQZMw00bbn0BPYUjbvte/
UJbML28BXrbLt/cLQTbtcdBU0+6uI5VNZGd7OfRc/4WEiumiRkHGFuPbWOJ0XMmQ
Ur3vkloUAeCyUo+SZccUOXsFdUbckgQK/EgTbHe8JgDOmL0mlQMmZ14uYwVYNWj+
8iUwLHGKKCJzaCt4YkRQg9wGyMYQtOmV14E8Ab9qFA5PLYrLeg/smPSJzs5Ad5jf
7NXfslgDwwrDVCrJ+NsY
=JuAb
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.