Openwall Project   /home  Owl  JtR  Pro  crypt  pam_passwdqc  tcb  phpass  scanlogd  popa3d  msulogin  /  Linux  BIND  /  advisories  presentations  /  services  donations  /  wordlists  passwords  /  news  community  lists  wiki  CVSweb  mirrors  signatures
bringing security into open environments
 
Password Recovery Resources on the Net
[<prev] [next>] [<thread-prev] [month] [year] [list]
Date: Mon, 25 Aug 2008 12:35:46 -0600
From: Vincent Danen <vdanen@...sec.ca>
To: oss-security@...ts.openwall.com
Subject: Re: Re: [vendor-sec] Re: Re: libxml2
	denial of service flaw (CVE-2008-3281)

* [2008-08-25 20:13:03 +0200] Florian Weimer wrote:

>* Vincent Danen:
>
>> Does anyone know if this affects anything other than librsvg?
>
>It's unclear if struct xmlEntity (especially its external allocation) is
>part of the public API or not.
>
>liferea 1.4.16b has this:
>
>  src/xml.c:                    entity = (xmlEntityPtr)g_new0 (xmlEntity, 1);
>
>PHP 5.2.6 has this:
>
>  ext/dom/dom_iterators.c:61:      ret = (xmlEntityPtr) xmlMalloc(sizeof(xmlEntity));
>  ext/dom/dom_iterators.c:62:      memset(ret, 0, sizeof(xmlEntity));
>
>QT 4.4.0 has this (with an instructive comment in front of it):
>
>  src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp:static xmlEntity sharedXHTMLEntity = {
>
>(This is not the result of an exhaustive search.)

Thanks, Florian.  Looks like just recompiling librsvg may not be a good
idea.

-- 
Vincent Danen @ http://linsec.ca/

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux