mailing list archives
Re: Re: libxml security fix from apple ... any information?
From: Jeffrey Czerniak <jeffcz () apple com>
Date: Sat, 30 Jul 2011 13:50:40 -0700
On Jul 29, 2011, at 1:56 AM, Moritz Muehlenhoff wrote:
Thomas Biege wrote:
if the code executed is the same on Windows and on Linux I would assume
this affects Linux too. That the bug is not "seen" during fuzzing
Grepping through the codebase show quite a few _WIN32 ifdefs, though.
But of course we need to see the patch applied by Apple.
The patch we applied has been shared with Daniel Veillard of the libxml2 project.
We understand this issue may affect other distributors of libxml2, and we have not seen evidence that our patch has
been applied upstream. We do not feel it is prudent to share the patch on a public mailing list such as oss-security,
as we do not wish to inadvertently facilitate exploitation of the issue if other distributors are affected.
We would like to cooperate with other downstream distributors of free and open source software on security issues, as
Apple is a major distributor of such software. However, our previous attempts to engage the community have not been
successful. One-way disclosure of information related to security issues subjects our customers to non-trivial risk
without providing any added security benefit. This is particularly pertinent if the disclosure were to occur in
advance of the release of fixed software.
Apple Product Security Response
jeffcz () apple com