Bug 15803

Summary:	perl-XML-LibXML new security issue CVE-2015-3451
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	jquelin, mageia, oe, shlomif, sysadmin-bugs, vzawalin1
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/642877/
Whiteboard:	has_procedure advisory mga4-32-ok mga4-64-ok
Source RPM:	perl-XML-LibXML-2.11.600-7.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2015-04-30 18:34:03 CEST

A CVE has been assigned for an issue fixed in XML::LibXML 2.0119:
http://openwall.com/lists/oss-security/2015/04/30/1

Reproducible: 

Steps to Reproduce:

David Walser 2015-04-30 18:34:19 CEST

CC: (none) => mageia, shlomif
Whiteboard: (none) => MGA5TOO, MGA4TOO

David Walser 2015-05-01 18:09:55 CEST

URL: (none) => http://lwn.net/Vulnerabilities/642877/

David Walser 2015-05-04 23:51:24 CEST

Blocks: (none) => 14674

Comment 1 Vladimir Zawalinski 2015-05-05 05:37:17 CEST

Testing MGA4.1  32 and 64 bit, Vbox hardware.

Testing will be limited to executing a trivial script pre and post update in each architecture.

CC: (none) => vzawalin1

Comment 2 Shlomi Fish 2015-05-05 09:50:28 CEST

(In reply to Vladimir Zawalinski from comment #1)
> Testing MGA4.1  32 and 64 bit, Vbox hardware.
> 
> Testing will be limited to executing a trivial script pre and post update in
> each architecture.

Vladimir, you can also run the test suite from the source distribution using Â«prove t/*.tÂ».

Comment 3 Vladimir Zawalinski 2015-05-05 11:50:14 CEST

Thank you Shlomi - I'll try that.

Comment 4 David Walser 2015-05-05 13:07:45 CEST

There's nothing to test yet, no update has been posted.

Comment 5 Vladimir Zawalinski 2015-05-05 13:18:25 CEST

That explains it

Comment 6 Oden Eriksson 2015-05-05 15:47:03 CEST

Fixed with perl-XML-LibXML-2.10.0-2.1.mga4

CC: (none) => oe

Comment 7 David Walser 2015-05-05 15:48:07 CEST

(In reply to David Walser from comment #4)
> There's nothing to test yet, no update has been posted.

Now there is :o)  Thanks Oden.

Still waiting for it to be pushed in Cauldron before assigning to QA, but you can test the Mageia 4 update now.

Comment 8 David Walser 2015-05-06 14:32:30 CEST

Patched package uploaded for Mageia 4.

Updated package uploaded for Cauldron.  Thanks again Shlomi and Oden!

Mageia 4 package is listed in Comment 6.

Advisory:
========================

Updated perl-XML-LibXML package fixes security vulnerability:

Tilmann Haak from xing.com discovered that XML::LibXML did not respect the
expand_entities parameter to disable processing of external entities in some
circumstances. This may allow attackers to gain read access to otherwise
protected ressources, depending on how the library is used (CVE-2015-3451).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3451
https://www.debian.org/security/2015/dsa-3243

CC: (none) => jquelin
Version: Cauldron => 4
Blocks: 14674 => (none)
Assignee: jquelin => qa-bugs
Whiteboard: MGA5TOO, MGA4TOO => (none)

Comment 9 claire robinson 2015-05-06 18:55:01 CEST

Testing complete mga4 32 & 64

Self tests are run at build time and the package is required by urpmi so just ensured the packages update cleanly and urpmi isn't broken.

Comment 10 claire robinson 2015-05-06 18:58:40 CEST

Validating. Advisory uploaded.

Please push to 4 updates

Thanks!

Keywords: (none) => validated_update
Whiteboard: (none) => has_procedure advisory mga4-32-ok mga4-64-ok
CC: (none) => sysadmin-bugs

Comment 11 Mageia Robot 2015-05-06 19:11:19 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0199.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED