Bug 600842 – games-util/xgamer: Package uses dev-perl/XML-Twig and makes no clear statement regarding handling of external entities (CVE-2016-9180)

• Status: RESOLVED WONTFIX
• Product: Gentoo Security

[Description Thomas Deutschmann (RETIRED) 2016-11-25 17:49:58 UTC]

It is suspected that this package is vulnerable to a security vulnerability due to expanding of malicious entities via dev-perl/XML-Twig. As such we ask maintainers with packages suspected to be vulnerable to verify if the package is (or have been) affected. 

Please see the information contained in the tracker bug 600818.


# grep -Fr 'Twig->new' /var/tmp/portage/games-util/xgamer-0.6.2/work/xgamer
/var/tmp/portage/games-util/xgamer-0.6.2/work/xgamer/bin/xgamer:    my $twig = XML::Twig->new(

[Comment 1 D'juan McDonald (domhnall) 2017-09-20 08:45:29 UTC]

Tested on 9/20/2017 ---

developer / # grep -Fr 'use XML' xgamer

xgamer/bin/xgamer:use XML::Twig;
xgamer/bin/xgamer:    my $twig = XML::Twig::Elt->new($tag);
xgamer/bin/xgamer:    my $twig = XML::Twig->new(
xgamer/bin/xgamer:    # Return XML as string 
xgamer/Build.PL:	'XML::Twig' => 0

Daj Uan (jmbailey)
Gentoo Security Padawan

[Comment 2 Michael Boyle 2018-04-26 03:27:11 UTC]

Red Hat and upstream wontfix. No concerns with any other major vulnerabilities.