Multiple Vulnerabilities Using the record of this email, we are going to request CVEs from MITRE.
We don't use the bundled libxml2 version of this gem so this should already be fixed. libxml-2.9.0 has been in the tree for a long time so we should stable this and drop libxml-2.8.0. Arches, please mark this new version stable.
(In reply to Hans de Graaff from comment #1) > We don't use the bundled libxml2 version of this gem so this should already > be fixed. libxml-2.9.0 has been in the tree for a long time so we should > stable this and drop libxml-2.8.0. > > Arches, please mark this new version stable. I guess Michael intended dev-libs/libxml2
This was my fault actually, when helping him create the bug. I pulled up the wrong libxml. Thank you ago... redirecting. ______________________________ FROM URL: In a fuzzing session with AFLGo, a directed version of AFL/AFLFast, we found four crashers (two invalid writes and two invalid reads) in LibXML2. These were reported to the maintainers one month ago. We provided analysis and patches and sent several email-reminders, explaining our intend to disclose, but there has been no response. The bug reports are currently not public. So, in the spirit of full disclosure, we attach the bug reports with analysis and patches here. Using the record of this email, we are going to request CVEs from MITRE.
*** Bug 618618 has been marked as a duplicate of this bug. ***
*** Bug 622556 has been marked as a duplicate of this bug. ***
CVE-2017-0663 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-0663): A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. CVE-2017-9047 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9047): A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9048 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9048): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash. CVE-2017-9049 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9049): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398. CVE-2017-9050 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9050): libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.
Patch for this issue have been pushed in libxml-2.9.4-r2. Please note that: * patches where cherry-picked from upstream master according to information found in this ticket, some patches were harder to find due to upstream blocking access to it. * unittests in the ebuild are actually not being run for a long time certainly due to a problem when porting to multilib. Maybe it existed before, didn't check yet. Anyway, as lots of other security related fixes are pending an upstream release, I pushed this as a stop gap until I get more time to do a proper snapshot and fix these unittests issues.
Note that CVE-2017-0663 is not included as it seemed to be a dedicated CVE for Android and separate CVE seem to have been assigned to libxml2 upstream.
This issue was resolved and addressed in GLSA 201711-01 at https://security.gentoo.org/glsa/201711-01 by GLSA coordinator Christopher Diaz Riveros (chrisadr).
