Date: Thu, 22 Oct 2009 16:04:37 +0200 From: Marc Schoenefeld <mschoene@...hat.com> To: oss-security <oss-security@...ts.openwall.com> CC: "Steven M. Christey" <coley@...us.mitre.org>, Joe Orton <jorton@...hat.com>, Ondrej Vasik <ovasik@...hat.com>, Roman Rakus <rrakus@...hat.com>, CERT-FI Vulnerability Co-ordination <vulncoord@...ora.fi> Subject: Re: Regarding expat bug 1990430 Jan Lieskovsky wrote: > Hello Steve, vendors, > > [...] > > a, Does Apache Xerces2 Java contain embedded copy ot the expat > library (i.e. it's > completely the same issue as in expat, w3c-libwww, PyXML and > others) - Marc > could you help to reply this question? > Hi, the upstream patch for CVE-2009-2625 for xerces-j2 is java-only  and unrelated to fixes in other native C parsing libraries. Regards Marc  http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h -- Marc Schoenefeld / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ