From owner-freebsd-ports-bugs@FreeBSD.ORG Wed Nov 19 20:50:02 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6F8CA1065673; Wed, 19 Nov 2008 20:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 4B4908FC0C; Wed, 19 Nov 2008 20:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id mAJKo2OU055551; Wed, 19 Nov 2008 20:50:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id mAJKo2AT055550; Wed, 19 Nov 2008 20:50:02 GMT (envelope-from gnats) Resent-Date: Wed, 19 Nov 2008 20:50:02 GMT Resent-Message-Id: <200811192050.mAJKo2AT055550@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@freebsd.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Cc: gnome@freebsd.org, freebsd-security@freebsd.org, pluknet@gmail.com, mezz@freebsd.org Resent-Reply-To: FreeBSD-gnats-submit@freebsd.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4C218106564A for ; Wed, 19 Nov 2008 20:41:04 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id E81258FC0A for ; Wed, 19 Nov 2008 20:41:03 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from phoenix.codelabs.ru (ppp85-141-163-250.pppoe.mtu-net.ru [85.141.163.250]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1L2trC-00042M-Km for FreeBSD-gnats-submit@freebsd.org; Wed, 19 Nov 2008 23:41:02 +0300 Message-Id: <20081119204101.5FBD7F181F@phoenix.codelabs.ru> Date: Wed, 19 Nov 2008 23:41:01 +0300 (MSK) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 X-GNATS-Notify: gnome@freebsd.org, freebsd-security@freebsd.org, pluknet@gmail.com, mezz@freebsd.org Cc: Subject: ports/128998: [vuxml] document vulnerabilities in textproc/libxml2 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Nov 2008 20:50:02 -0000 >Number: 128998 >Category: ports >Synopsis: [vuxml] document vulnerabilities in textproc/libxml2 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Nov 19 20:50:01 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 7.1-PRERELEASE i386 >Organization: Code Labs >Environment: System: FreeBSD 7.1-PRERELEASE i386 >Description: The fix for the CVE-2008-4225 and CVE-2008-4226 was commited to the textproc/libxml2 just an hour ago, but vulnerabilities seem to be left undocumented. At least I was not able to find the corresponding PR and reporting channels are not clear from the commit comment. >How-To-Repeat: http://secunia.com/Advisories/32773/ http://www.freebsd.org/cgi/cvsweb.cgi/ports/textproc/libxml2/Makefile >Fix: The following VuXML entry should be evaluated and added: --- vuln.xml begins here --- libxml2 -- two integer overflow vulnerabilities libxml2 2.6.32_2

Secunia reports:

Two vulnerabilities have been reported in Libxml2, which can be exploited by malicious people to cause a Denial of Service or to potentially compromise an application using the library.

  1. An integer overflow error in the “xmlSAX2Characters()” function can be exploited to trigger a memory corruption via a specially crafted XML file. Successful exploitation may allow execution of arbitrary code, but requires e.g. that the user is tricked into processing an overly large XML file (2GB or more).
  2. An integer overflow error in the “xmlBufferResize()” function can be exploited to trigger the execution of an infinite loop.
 CVE-2008-4225 CVE-2008-4226 http://secunia.com/Advisories/32773/ https://bugzilla.redhat.com/show_bug.cgi?id=470466 https://bugzilla.redhat.com/show_bug.cgi?id=470480 2008-11-07 --- vuln.xml ends here --- >Release-Note: >Audit-Trail: >Unformatted: