[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUD3cMU9-do-SW6mHVSTyKN1c0x6VbMa2wHQakN7LRagRw@mail.gmail.com>
Date: Sun, 19 Apr 2015 10:15:41 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: libxml2 issue: out-of-bounds memory access when
parsing an unclosed HTML comment
Uh, so I guess we could also mention this one:
https://bugzilla.gnome.org/show_bug.cgi?id=744980
I wasn't sure it would ever cause anything serious / interesting,
though. Perhaps for some exotic uses?
/mz
On Sun, Apr 19, 2015 at 10:11 AM, Reed Loden <reed@...dloden.com> wrote:
> (saw this randomly today on Twitter, so figured I'd send it on to make sure
> it gets a CVE and actually gets fixed)
>
> https://hackerone.com/reports/57125#activity-384861
>
> """
> This is an out-of-bounds memory access in libxml2. By entering a unclosed
> html comment such as <!-- the libxml2 parser didn't stop parsing at the end
> of the buffer, causing random memory to be included in the parsed comment
> that was returned to ruby. In Shopify, this caused ruby objects from
> previous http requests to be disclosed in the rendered page.
>
> Link to the issue in libxml2's bugtracker:
> https://bugzilla.gnome.org/show_bug.cgi?id=746048
>
> A patched version of nokogiri (which uses a embedded libxml2) is available
> here:
> https://github.com/Shopify/nokogiri/compare/1b1fcad8bd64ab70256666c38d2c998e86ade8c0...master
>
> This bug is still not patched upstream, but both libxml2 and nokogiri
> developers are aware of the issue.
> """
>
> ~reed
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
