Bug 1026099 (CVE-2016-9596)

Summary:	VUL-0: CVE-2016-9596: libxml2: stack exhaustion while parsing xml files in recovery mode
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Tomáš Chvátal <tchvatal>
Status:	RESOLVED DUPLICATE	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/178060/
Whiteboard:	CVSSv2:NVD:CVE-2016-3627:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2016-9596:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2016-3627:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2016-9596:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:SUSE:CVE-2016-3627:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:SUSE:CVE-2016-9596:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2016-3627:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSSv3:NVD:CVE-2016-9596:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Marcus Meissner 2017-02-20 10:12:22 UTC

via redhat bugzilla

libxml2: stack exhaustion while parsing xml files in recovery mode

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1408302

Comment 1 Marcus Meissner 2017-02-20 10:12:42 UTC

from redhat bug


Comment 2 Salvatore Bonaccorso 2016-12-22 15:45:27 EST

Are there any details available for this? Upsteam bug, commit reference?

Comment 4 Tomas Hoger 2017-01-02 05:21:14 EST

(In reply to Salvatore Bonaccorso from comment #2)
> Are there any details available for this? Upsteam bug, commit reference?

This and the other two should be for a Red Hat specific security regressions, effectively duplicates of other public CVEs.  I'm going to ask Bharti to fix these bugs up properly.

Comment 2 Marcus Meissner 2017-02-20 10:15:03 UTC

This is a redhat assigned duplicate of CVE-2016-3627 / bug 972335

*** This bug has been marked as a duplicate of bug 972335 ***

Comment 3 Marcus Meissner 2017-02-20 10:29:27 UTC

*** Bug 1026101 has been marked as a duplicate of this bug. ***