Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Request: libxml2 external parsed entities issue
From: Nicolas Grégoire <nicolas.gregoire () agarri fr>
Date: Mon, 28 Oct 2013 19:17:51 +0100

libxml2 earlier than 2.9.0 fetches external parsed entities by
default, with no way to disable the behaviour.

Fixed by the following commit:


Hrm, I would have thought CVE-2013-0339 was for the entities expansion DoS issue
fixed by this commit:


The other one is for external entities expansion being enabled by default with
no way to turn it off. You would lump them together?

It's still unclear to me what exactly CVE-2013-0339 covers.

Patch for the entity expansion DoS:

Patch for not expanding external entities by default:

Are both patches covered? The second one is quite important as it kills
the classic XXE vector <!ENTITY foo SYSTEM "/etc/passwd">

For Ubuntu, CVE-2013-0339 covers the XXE attack.

For Debian, it's "large memory consumption" only:

For RedHat, it covers both but "libxml2 already provides mechanisms to
disable external entities which applications can use. Closing this flaw
as 'wontfix'": https://bugzilla.redhat.com/show_bug.cgi?id=915149

And the official page for the CVE isn't helpful:

Nicolas Grégoire

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]