Bug 960674 (CVE-2015-8710) - VUL-0: CVE-2015-8710: libxml2: out-of-bounds memory access when parsing an unclosed HTML comment
Summary: VUL-0: CVE-2015-8710: libxml2: out-of-bounds memory access when parsing an un...
Status: RESOLVED FIXED
Alias: CVE-2015-8710
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2016-01-22
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/160226/
Whiteboard: CVSSv2:RedHat:CVE-2015-8710:4.3:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-05 09:02 UTC by Johannes Segitz
Modified: 2019-09-25 15:55 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
upstream patch (1.72 KB, patch)
2016-01-07 09:43 UTC, Kristyna Streitova
Details | Diff
xx.c (592 bytes, text/plain)
2016-01-20 07:45 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2016-01-05 09:02:28 UTC
rh#1213957

http://seclists.org/oss-sec/2015/q2/214):
"This is an out-of-bounds memory access in libxml2. By entering a unclosed
html comment such as <!-- the libxml2 parser didn't stop parsing at the end
of the buffer, causing random memory to be included in the parsed comment
that was returned to ruby. In Shopify, this caused ruby objects from
previous http requests to be disclosed in the rendered page.

Link to the issue in libxml2's bugtracker:
https://bugzilla.gnome.org/show_bug.cgi?id=746048
"

Upstream patch: https://git.gnome.org/browse/libxml2/commit/?id=e724879d964d774df9b7969fc846605aa1bac54c

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1213957
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8710
http://seclists.org/oss-sec/2015/q4/616
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8710.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710
Comment 1 Swamp Workflow Management 2016-01-05 23:00:13 UTC
bugbot adjusting priority
Comment 2 Kristyna Streitova 2016-01-07 09:43:43 UTC
Created attachment 661086 [details]
upstream patch

SLE
---

Attaching the upstream patch that suits all SLE maintained products.


openSUSE
--------
- 13.1 and 13.2 are not affected
- Leap is affected but it will be fixed via SLE12
- Factory is affected but it will be updated to version 2.9.3 soon (which has this problem fixed)
Comment 3 SMASH SMASH 2016-01-08 15:03:23 UTC
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Jan. 22, 2016".

When done, reassign the bug to "security-team@suse.de".
/update/121235/.
Comment 4 Swamp Workflow Management 2016-01-08 15:07:08 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-01-22.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62418
Comment 5 SMASH SMASH 2016-01-08 15:08:07 UTC
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Jan. 22, 2016".

When done, reassign the bug to "security-team@suse.de".
/update/62418/.
Comment 8 Kristyna Streitova 2016-01-12 13:53:15 UTC
SLE submissions overview:

| Product  | Request |
|----------|---------|
| SLE10SP3 | #88216  |
| SLE11SP1 | #88212  |
| SLE12    | #88208  |


Reassigning to security team.
Comment 10 Marcus Meissner 2016-01-20 07:45:10 UTC
Created attachment 662441 [details]
xx.c

gcc -O2 -o xx xx.c -lxml2
valgrind ./xx
Comment 11 Swamp Workflow Management 2016-01-20 16:11:59 UTC
SUSE-SU-2016:0178-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 960674
CVE References: CVE-2015-8710
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libxml2-2.9.1-17.1
SUSE Linux Enterprise Software Development Kit 12 (src):    libxml2-2.9.1-17.1
SUSE Linux Enterprise Server 12-SP1 (src):    libxml2-2.9.1-17.1, python-libxml2-2.9.1-17.1
SUSE Linux Enterprise Server 12 (src):    libxml2-2.9.1-17.1, python-libxml2-2.9.1-17.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libxml2-2.9.1-17.1, python-libxml2-2.9.1-17.1
SUSE Linux Enterprise Desktop 12 (src):    libxml2-2.9.1-17.1, python-libxml2-2.9.1-17.1
Comment 12 Swamp Workflow Management 2016-01-21 16:13:08 UTC
SUSE-SU-2016:0187-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 960674
CVE References: CVE-2015-8710
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libxml2-2.7.6-0.37.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    libxml2-2.7.6-0.37.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Server 11-SP4 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Server 11-SP3 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Desktop 11-SP4 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Desktop 11-SP3 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    libxml2-2.7.6-0.37.1, libxml2-python-2.7.6-0.37.4
Comment 13 Swamp Workflow Management 2016-01-21 16:13:26 UTC
openSUSE-SU-2016:0188-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 960674
CVE References: CVE-2015-8710
Sources used:
openSUSE Leap 42.1 (src):    libxml2-2.9.1-13.1, python-libxml2-2.9.1-13.1
Comment 14 Andreas Stieger 2016-01-22 09:16:33 UTC
All done
Comment 15 Tristan Ye 2016-08-01 07:41:59 UTC
As we saw request for 11SP1 also has been initialized:

| Product  | Request |
|----------|---------|
| SLE11SP1 | #88212  |

May I know where is the fix for SLE11SP1 accordingly for this CVE?
Comment 16 Marcus Meissner 2016-08-01 08:14:57 UTC
sles11 sp1 ltss does not receive proactive updates anymore. If you have a valid contract covering sles11 sp1 ltss, request the update over our NTS teams as usual.