Bugzilla – Bug 920810
VUL-0: CVE-2015-0252: Xerces-c: Vulnerability in Apache Xerces-C XML parser
Last modified: 2018-03-15 23:48:59 UTC
via distros, embargoed CRD: 2015-03-13 probably A denial of service vulnerability was reported in January to the Apache Xerces-C PMC. The CVE is CVE-2015-0252 and the draft advisory for it is below. The supported version of this library is currently V3.1.1 and I have been accepted as a committer to push out a V3.1.2 patch release that includes this bug fix. The current patch being tested is at the end of this email. Note that some older but still "active" Linux distributions include versions of the parser as old as 2.8.0, which has been unsupported for many, many years. I don't know if this patch applies to that release. A beta release of V3.1.2 is available now [1] and will be formally announced this afternoon. A vote to release it is planned for next week, so the release and a public dislosure would be expected around March 13th. Scott Cantor Shibboleth Consortium Apache PMC, Santuario and Committer, Xerces-C [1] http://people.apache.org/~scantor/ - --- CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Xerces-C XML Parser library versions prior to V3.1.2 Description: The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. The bug does not appear to allow for remote code execution, but is a denial of service attack that in many applications may allow for an unauthenticated attacker to supply malformed input and cause a crash. Mitigation: Applications that are using library versions older than V3.1.2 should upgrade as soon as possible. Distributors of older versions should apply the patches from this subversion revision: http://svn.apache.org/viewvc?view=revision&revision=TBD Credit: This issue was reported independently by Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and by Ben Laurie of Google. References: http://xerces.apache.org/xerces-c/ http://TBD/CVE-2015-0252.txt - ---- Planned patch for vulnerability:
Created attachment 625499 [details] patch attached patch
bugbot adjusting priority
CRD was shifted, not fixed, please check before opening this bug. CRD: 2015-03-19
public via oss-sec CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Xerces-C XML Parser library versions prior to V3.1.2 Description: The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. The bug does not appear to allow for remote code execution, but is a denial of service attack that in many applications may allow for an unauthenticated attacker to supply malformed input and cause a crash. Mitigation: Applications that are using library versions older than V3.1.2 should upgrade as soon as possible. Distributors of older versions should apply the patches from this subversion revision: http://svn.apache.org/viewvc?view=revision&revision=1667870 Credit: This issue was reported independently by Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and by Ben Laurie of Google. References: http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt
SUSE-SU-2015:0597-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 920810 CVE References: CVE-2015-0252 Sources used: SUSE Linux Enterprise Workstation Extension 12 (src): xerces-c-3.1.1-4.1 SUSE Linux Enterprise Desktop 12 (src): xerces-c-3.1.1-4.1
done
This is an autogenerated message for OBS integration: This bug (920810) was mentioned in https://build.opensuse.org/request/show/381243 13.2 / xerces-c
This is an autogenerated message for OBS integration: This bug (920810) was mentioned in https://build.opensuse.org/request/show/381546 13.2 / xerces-c
openSUSE-SU-2016:0966-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 920810,966822 CVE References: CVE-2015-0252,CVE-2016-0729 Sources used: openSUSE 13.2 (src): xerces-c-3.1.1-13.3.1
Created attachment 689774 [details] CVE-2015-0252.xml QA Reproducer: SAXCount CVE-2015-0252.xml