Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/17/2013 06:45 AM, Agostino Sarubbo wrote:
> From the secunia advisory SA53061[1]:
>
> 1) An use-after-free error in "htmlParseChunk()" can be exploited
> to dereference already freed memory.

Please use CVE-2013-1969 for this issue.

> 2) Two use-after-free errors in "xmldecl_done()" can be exploited
> to dereference already freed memory.

Please use CVE-2013-1970 for this issue.

> The vulnerabilities are reported in version 2.9.0. Other versions
> may also be affected.
>
> Commit: 
> https://git.gnome.org/browse/libxml2/commit/?id=de0cc20c29cb3f056062925395e0f68d2250a46f
>
>  [1]: https://secunia.com/advisories/53061/

Thanks

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRcFSrAAoJEBYNRVNeJnmT7FIQAILwU3b8RiSi+4dxRfhBR7cy
CxTLquS7ORT6LJFmcZlMki+1hgOPIrHItM4Mh6xTQZFQaGkkxS4x/zP6G+4iIN6O
h4jtGu913B9EfSS55r5t8gZ4KtfyJHYyS+Rwoo9UiFLqTXKtB/6kU1t2wK/wCGOh
8WMTtCt+6NMUu3l7v30buzdng2AzDLiAT+vdYTNH6hDvqeiJZDzfvI1qejxWsCvl
ACGN4gJi3EqHqVdu29nRZ2YXp1ov4FAjvomY6oT2gN3VKSSDZ9arb+S6QIKztLUA
9AecGgsguiq29Yp76MFpy4kCfXwx32cs2Hl/pG3fRDMmpYVVjoNv2exV11hRYSAs
ogRFDbZeYMUAXCbX361vCuIDN7YoVg5E+0sGg0BGWVmRnfcKN8hcuSLozP/Q66qC
YMvqqDzKZhdbjrIVVyHGL+zRdTDVAf789rr+oM027XBtQZMw00bbn0BPYUjbvte/
UJbML28BXrbLt/cLQTbtcdBU0+6uI5VNZGd7OfRc/4WEiumiRkHGFuPbWOJ0XMmQ
Ur3vkloUAeCyUo+SZccUOXsFdUbckgQK/EgTbHe8JgDOmL0mlQMmZ14uYwVYNWj+
8iUwLHGKKCJzaCt4YkRQg9wGyMYQtOmV14E8Ab9qFA5PLYrLeg/smPSJzs5Ad5jf
7NXfslgDwwrDVCrJ+NsY
=JuAb
-----END PGP SIGNATURE-----