oss-security - CVE request libaxl <= 0.6.9

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <3D99FF28-9D4E-415F-BAB6-8F55FBC3CFDB@bogaard.eu>
Date: Tue, 28 Apr 2015 09:15:29 +0200
From: "J. M. Bogaard" <martijn@...aard.eu>
To: oss-security@...ts.openwall.com
Subject: CVE request libaxl <= 0.6.9

Hi,

I would like to request a CVE for an issue I have found some time ago. I’m coordinating this together with the developers of libaxl (which will release a fix later today).

Because of a bug in the memory allocator of libaxl can the parsing of a specially crafted xml document result in a heap overflow.

There is at least 1 known case where an application uses libaxl to parse incoming user supplied xml data, unauthenticated and over the network. In the best situation this results in DoS by memory corruption, but RCE is for a (skilled) attacker most likely within range.

I hope this is all the information you need, as this is my first CVE request ;-)

Regards,

Martijn

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.