Bug 979441 (CVE-2016-0718) - VUL-0: CVE-2016-0718: expat: XML Parser Crashes on Malformed Input
Summary: VUL-0: CVE-2016-0718: expat: XML Parser Crashes on Malformed Input
Status: RESOLVED FIXED
Alias: CVE-2016-0718
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2016-05-25
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2016-0718:6.8:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-11 09:02 UTC by Sebastian Krahmer
Modified: 2017-05-11 01:07 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Patch from upstream (25.00 KB, patch)
2016-05-11 09:06 UTC, Sebastian Krahmer
Details | Diff
PoC from upstream (1.64 KB, application/x-bzip)
2016-05-11 09:07 UTC, Sebastian Krahmer
Details
Patch from upstream v2 (25.08 KB, patch)
2016-05-18 12:51 UTC, Kristyna Streitova
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2016-05-11 09:02:35 UTC
EMBARGOED until CRD: 2016-05-17

CVE-2016-0718: Expat XML Parser Crashes on Malformed Input

via pre-notification:

Severity: Critical

Versions Affected: All Expat XML Parser library versions

Description: The Expat XML parser mishandles certain kinds of malformed
input documents, resulting in buffer overflows during processing and error
reporting. The overflows can manifest as a segmentation fault or as memory
corruption during a parse operation. The bugs allow for a denial of service
attack in many applications by an unauthenticated attacker, and could
conceivably result in remote code execution.

Mitigation: Applications that are using Expat should apply the attached patch as soon as possible.

Credit: this issue was reported by Gustavo Grieco

and patched by:

* Christian Heimes
* Karl Waclawek
* Gustavo Grieco
* Sebastian Pipping
Comment 1 Sebastian Krahmer 2016-05-11 09:06:34 UTC
Created attachment 676489 [details]
Patch from upstream

.
Comment 2 Sebastian Krahmer 2016-05-11 09:07:06 UTC
Created attachment 676490 [details]
PoC from upstream

.
Comment 3 Swamp Workflow Management 2016-05-11 13:23:28 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-05-25.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62734
Comment 8 Kristyna Streitova 2016-05-18 12:51:20 UTC
Created attachment 677437 [details]
Patch from upstream v2

Updated upstream patch.
Comment 9 Kristyna Streitova 2016-05-18 12:55:14 UTC
(In reply to Johannes Segitz from comment #7)
> Yes, please include the updated patch and the fix for bnc#980391

All done.

Summary of submissions:

|     Codestream     | Request  |
|--------------------|----------|
| SUSE:SLE-11:Update | #114767  |
| SUSE:SLE-12:Update | #114768  |
| openSUSE:13.2      | #396617  |
| openSUSE:Leap:42.1 | -*       |
| openSUSE:Factory   | #396618  |

* via SLE12


Reassigning to the security team.
Comment 10 Bernhard Wiedemann 2016-05-18 13:00:12 UTC
This is an autogenerated message for OBS integration:
This bug (979441) was mentioned in
https://build.opensuse.org/request/show/396617 13.2 / expat
Comment 12 Marcus Meissner 2016-05-18 13:10:48 UTC
is public
Comment 13 Kristyna Streitova 2016-05-25 12:19:54 UTC
(In reply to Kristyna Streitova from comment #9)
> |     Codestream     | Request  |
> |--------------------|----------|
> | SUSE:SLE-11:Update | #114767  |
> | SUSE:SLE-12:Update | #114768  |
> | openSUSE:13.2      | #396617  |
> | openSUSE:Leap:42.1 | -*       |
> | openSUSE:Factory   | #396618  |
> 
> * via SLE12

Submitted for SLE10SP3:

| SUSE:SLE-10-SP3    | #115250  |
Comment 15 Swamp Workflow Management 2016-05-30 12:09:28 UTC
openSUSE-SU-2016:1441-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 979441,980391
CVE References: CVE-2015-1283,CVE-2016-0718
Sources used:
openSUSE 13.2 (src):    expat-2.1.0-14.3.1
Comment 16 Swamp Workflow Management 2016-06-07 11:08:11 UTC
SUSE-SU-2016:1508-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 979441,980391
CVE References: CVE-2015-1283,CVE-2016-0718
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    expat-2.1.0-17.1
SUSE Linux Enterprise Software Development Kit 12 (src):    expat-2.1.0-17.1
SUSE Linux Enterprise Server 12-SP1 (src):    expat-2.1.0-17.1
SUSE Linux Enterprise Server 12 (src):    expat-2.1.0-17.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    expat-2.1.0-17.1
SUSE Linux Enterprise Desktop 12 (src):    expat-2.1.0-17.1
Comment 17 Swamp Workflow Management 2016-06-07 15:09:00 UTC
SUSE-SU-2016:1512-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 979441,980391
CVE References: CVE-2015-1283,CVE-2016-0718
Sources used:
SUSE Studio Onsite 1.3 (src):    expat-2.0.1-88.38.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    expat-2.0.1-88.38.1
SUSE Linux Enterprise Server 11-SP4 (src):    expat-2.0.1-88.38.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    expat-2.0.1-88.38.1
Comment 18 Swamp Workflow Management 2016-06-08 10:07:57 UTC
openSUSE-SU-2016:1523-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 979441,980391
CVE References: CVE-2015-1283,CVE-2016-0718
Sources used:
openSUSE Leap 42.1 (src):    expat-2.1.0-17.1
Comment 19 Marcus Meissner 2016-06-09 14:19:19 UTC
released