Bug 13338

Summary:	libxml2 new security issue CVE-2014-0191
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	sysadmin-bugs, tmb
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/598319/
Whiteboard:	MGA3TOO has_procedure advisory mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok
Source RPM:	libxml2-2.9.1-2.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2014-05-07 21:03:14 CEST

A CVE has been assigned for a security issue fixed upstream in libxml2:
http://openwall.com/lists/oss-security/2014/05/06/4

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated libxml2 packages fix security vulnerability:

It was discovered that libxml2, a library providing support to read,
modify and write XML files, incorrectly performs entity substituton in
the doctype prolog, even if the application using libxml2 disabled any
entity substitution. A remote attacker could provide a
specially-crafted XML file that, when processed, would lead to the
exhaustion of CPU and memory resources or file descriptors (CVE-2014-0191).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0191
https://bugzilla.redhat.com/show_bug.cgi?id=1090976
========================

Updated packages in core/updates_testing:
========================
libxml2_2-2.9.0-5.3.mga3
libxml2-utils-2.9.0-5.3.mga3
libxml2-python-2.9.0-5.3.mga3
libxml2-devel-2.9.0-5.3.mga3
libxml2_2-2.9.1-2.1.mga4
libxml2-utils-2.9.1-2.1.mga4
libxml2-python-2.9.1-2.1.mga4
libxml2-devel-2.9.1-2.1.mga4

from SRPMS:
libxml2-2.9.0-5.3.mga3.src.rpm
libxml2-2.9.1-2.1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2014-05-07 21:03:19 CEST

Whiteboard: (none) => MGA3TOO

Comment 1 claire robinson 2014-05-08 14:51:22 CEST

Easy one to test: https://wiki.mageia.org/en/QA_procedure:Libxml2

Whiteboard: MGA3TOO => MGA3TOO has_procedure

Comment 2 claire robinson 2014-05-10 09:02:05 CEST

Testing complete mga3 32 & 64

Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure mga3-32-ok mga3-64-ok

Comment 3 claire robinson 2014-05-10 09:06:22 CEST

Testing complete mga4 32 & 64

Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok => MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok

Comment 4 claire robinson 2014-05-10 09:09:14 CEST

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok => MGA3TOO has_procedure advisory mga3-32-ok mga3-64-ok mga4-32-ok mga4-64-ok
CC: (none) => sysadmin-bugs

Comment 5 Thomas Backlund 2014-05-10 21:55:25 CEST

Update pushed:
http://advisories.mageia.org/MGASA-2014-0214.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

David Walser 2014-05-12 22:40:17 CEST

URL: (none) => http://lwn.net/Vulnerabilities/598319/

Comment 6 David Walser 2014-05-28 16:05:28 CEST

Apparently this caused a regression in xmllint, which OpenSuSE has pushed a fix for:
http://lists.opensuse.org/opensuse-updates/2014-05/msg00076.html

I've added the fix in Cauldron and checked it into Mageia 3 and Mageia 4 SVN.