oss-security - Re: Regarding expat bug 1990430

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / articles presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures / books
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 22 Oct 2009 16:04:37 +0200
From: Marc Schoenefeld <mschoene@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
CC: "Steven M. Christey" <coley@...us.mitre.org>,
        Joe Orton <jorton@...hat.com>, Ondrej Vasik <ovasik@...hat.com>,
        Roman Rakus <rrakus@...hat.com>,
        CERT-FI Vulnerability Co-ordination <vulncoord@...ora.fi>
Subject: Re: Regarding expat bug 1990430

Jan Lieskovsky wrote:
> Hello Steve, vendors,
>
> [...]
>
>    a, Does Apache Xerces2 Java contain embedded copy ot the expat
> library (i.e. it's
>       completely the same issue as in expat, w3c-libwww, PyXML and
> others) - Marc
>       could you help to reply this question?
>
Hi,
the upstream patch for CVE-2009-2625 for xerces-j2 is  java-only [1] and
unrelated to fixes in other native C parsing libraries.

Regards
Marc

[1]
http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h


-- 
Marc Schoenefeld / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.