Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 600834 - net-analyzer/wireshark: Package uses dev-perl/XML-Twig and makes no clear statement regarding handling of external entities (CVE-2016-9180)
Summary: net-analyzer/wireshark: Package uses dev-perl/XML-Twig and makes no clear sta...
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream?]
Keywords:
Depends on:
Blocks: 600818
  Show dependency tree
 
Reported: 2016-11-25 17:37 UTC by Thomas Deutschmann (RETIRED)
Modified: 2017-01-22 12:35 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-25 17:37:59 UTC
It is suspected that this package is vulnerable to a security vulnerability due to expanding of malicious entities via dev-perl/XML-Twig. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 600818.


# grep -Fr 'Twig->new' /var/tmp/portage/net-analyzer/wireshark-2.2.2/work/wireshark-2.2.2
/var/tmp/portage/net-analyzer/wireshark-2.2.2/work/wireshark-2.2.2/tools/process-x11-xcb.pl:    my $xml = XML::Twig->new(
/var/tmp/portage/net-analyzer/wireshark-2.2.2/work/wireshark-2.2.2/tools/process-x11-xcb.pl:    my $xml = XML::Twig->new(
/var/tmp/portage/net-analyzer/wireshark-2.2.2/work/wireshark-2.2.2/tools/process-x11-xcb.pl:    my $xml = XML::Twig->new(
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2017-01-22 12:35:28 UTC
tools/process-x11-xcb.pl is only used upstream and would fail when run in the distributed sources because those do not include (some files in) the mesa and xcb sources that are used as input.