Re: Re: libxml security fix from apple ... any information?

[Jeffrey Czerniak <jeffcz () apple com>]

On Jul 29, 2011, at 1:56 AM, Moritz Muehlenhoff wrote:
> Thomas Biege wrote:
>
> > Hello,
> > if the code executed is the same on Windows and on Linux I would assume
> > this affects Linux too. That the bug is not "seen" during fuzzing
> > means nothing.
>
> Grepping through the codebase show quite a few _WIN32 ifdefs, though.
>
> But of course we need to see the patch applied by Apple.
>
> Cheers,
>        Moritz


Hello Moritz,

The patch we applied has been shared with Daniel Veillard of the libxml2 project.

We understand this issue may affect other distributors of libxml2, and we have not seen evidence that our patch has 
been applied upstream.  We do not feel it is prudent to share the patch on a public mailing list such as oss-security, 
as we do not wish to inadvertently facilitate exploitation of the issue if other distributors are affected.

We would like to cooperate with other downstream distributors of free and open source software on security issues, as 
Apple is a major distributor of such software.  However, our previous attempts to engage the community have not been 
successful.  One-way disclosure of information related to security issues subjects our customers to non-trivial risk 
without providing any added security benefit.  This is particularly pertinent if the disclosure were to occur in 
advance of the release of fixed software.

Best regards,

----------------
Jeffrey Czerniak
Apple Product Security Response
jeffcz () apple com
----------------