66309 – dev-libs/libxml2, an overflow when parsing remote resources (<2.6.6)

Bug 66309 - dev-libs/libxml2, an overflow when parsing remote resources (<2.6.6)

Summary: dev-libs/libxml2, an overflow when parsing remote resources (<2.6.6)

Status:	RESOLVED DUPLICATE of bug 42735

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High normal (vote)
Assignee:	Gentoo Security

URL:	https://bugzilla.fedora.us/show_bug.c...
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2004-10-04 06:58 UTC by Marc V
Modified:	2011-10-30 22:38 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marc V 2004-10-04 06:58:02 UTC

Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml2 uses special
parsing routines.  These routines can overflow a buffer if passed a very
long URL.  If an attacker is able to find an application using libxml2
that parses remote resources and allows them to influence the URL, then
this flaw could be used to execute arbitrary code.  The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0110 to this issue.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.




patch available: https://bugzilla.fedora.us/attachment.cgi?id=566&action=view

Comment 1 Marc Vila 2004-10-04 07:03:45 UTC

sorry, i reported with my old account

bug shouldnt affect ~x86 users, since the bug only affects versions prior to 2.6.6, and ~x86 version is 2.6.12

Comment 2 Thierry Carrez (RETIRED) gentoo-dev

2004-10-04 07:20:10 UTC

Was GLSA 200403-01

*** This bug has been marked as a duplicate of 42735 ***