Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140506205558.37a107d1@redhat.com>
Date: Tue, 6 May 2014 20:55:58 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: nicolas.gregoire@...rri.fr
Subject: Re: CVE-2014-0191 libxml2: external parameter entity
 loaded when entity substitution is disabled

On Tue, 06 May 2014 20:21:28 +0200 Nicolas Grégoire wrote:

> > libxml2 [...] incorrectly performs entity substituton in the doctype
> > prolog, even if the application using libxml2 disabled any entity
> > substitution. 
> 
> I'm not sure that I understand this bug. Do you have a PoC?

The new issue is very similar to the one fixed by:

https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f

which is linked to the infamous CVE-2013-0339.  4629ee0 fixed the issue
for general entities, while the 9cd1c3c fixes the same type of problem
for parameter entities.  Even when parsing without NOENT, external
parameter entities are fetched.

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.