libxml2: CVE-2016-5131

Debian Bug report logs - #840554
libxml2: CVE-2016-5131

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libxml2: CVE-2016-5131

Date: Wed, 12 Oct 2016 20:17:47 +0200

Source: libxml2
Version: 2.9.4+dfsg1-2
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for libxml2.

CVE-2016-5131[0]:
| Use-after-free vulnerability in libxml2 through 2.9.4, as used in
| Google Chrome before 52.0.2743.82, allows remote attackers to cause a
| denial of service or possibly have unspecified other impact via
| vectors related to the XPointer range-to function.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-5131
[1] https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1358641#c3
[3] https://bugzilla.gnome.org/show_bug.cgi?id=768428 (not public)

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 840553@bugs.debian.org, 840554@bugs.debian.org

Subject: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Date: Sun, 30 Oct 2016 17:00:01 +0100

[Message part 1 (text/plain, inline)]

Control: tags 840553 + pending
Control: tags 840554 + pending

Dear maintainer,

I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore

[libxml2-2.9.4+dfsg1-2.1-nmu.diff (text/x-diff, attachment)]

Message #17 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 840553@bugs.debian.org

Cc: 840554@bugs.debian.org

Subject: Re: [xml/sgml-pkgs] Bug#840553: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Date: Sun, 30 Oct 2016 16:17:18 +0000

[Message part 1 (text/plain, inline)]

On Sun, Oct 30, 2016 at 05:00:01PM +0100, Salvatore Bonaccorso wrote:
> Control: tags 840553 + pending
> Control: tags 840554 + pending
> 
> Dear maintainer,
> 
> I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
> uploaded it to DELAYED/5. Please feel free to tell me if I
> should delay it longer.

Thanks, I'm rescheduling it to 0-day.

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Mattia Rizzolo <mattia@debian.org>

Cc: 840553@bugs.debian.org, 840554@bugs.debian.org

Subject: Re: [xml/sgml-pkgs] Bug#840553: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Date: Sun, 30 Oct 2016 17:23:49 +0100

Hi Mattia,

On Sun, Oct 30, 2016 at 04:17:18PM +0000, Mattia Rizzolo wrote:
> On Sun, Oct 30, 2016 at 05:00:01PM +0100, Salvatore Bonaccorso wrote:
> > Control: tags 840553 + pending
> > Control: tags 840554 + pending
> > 
> > Dear maintainer,
> > 
> > I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
> > uploaded it to DELAYED/5. Please feel free to tell me if I
> > should delay it longer.
> 
> Thanks, I'm rescheduling it to 0-day.

Thanks for confirming and doing so.

(and thanks as well for importing the diff into the packaging git
repository).

Regards,
Salvatore

Message #27 received at 840554-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 840554-close@bugs.debian.org

Subject: Bug#840554: fixed in libxml2 2.9.4+dfsg1-2.1

Date: Sun, 30 Oct 2016 16:35:36 +0000

Source: libxml2
Source-Version: 2.9.4+dfsg1-2.1

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 840554@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 16:30:55 +0100
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg libxml2-doc python-libxml2 python-libxml2-dbg python3-libxml2 python3-libxml2-dbg
Architecture: all source
Version: 2.9.4+dfsg1-2.1
Distribution: unstable
Urgency: medium
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 840553 840554
Description: 
 libxml2    - GNOME XML library
 libxml2-dbg - Debugging symbols for the GNOME XML library
 libxml2-dev - Development files for the GNOME XML library
 libxml2-doc - Documentation for the GNOME XML library
 libxml2-utils - XML utilities
 libxml2-utils-dbg - XML utilities (debug extension)
 python-libxml2 - Python bindings for the GNOME XML library
 python-libxml2-dbg - Python bindings for the GNOME XML library (debug extension)
 python3-libxml2 - Python3 bindings for the GNOME XML library
 python3-libxml2-dbg - Python3 bindings for the GNOME XML library (debug extension)
Changes:
 libxml2 (2.9.4+dfsg1-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix comparison with root node in xmlXPathCmpNodes
   * Fix XPointer paths beginning with range-to (CVE-2016-5131)
     (Closes: #840554)
   * Disallow namespace nodes in XPointer ranges (CVE-2016-4658)
     (Closes: #840553)
   * Fix more NULL pointer derefs in xpointer.c
Checksums-Sha1: 
 267a7d892b9be45ab462d18e2a3aafe2ff45303b 2992 libxml2_2.9.4+dfsg1-2.1.dsc
 a87cdd246581b9c16e76d85f370ce940261570c8 28036 libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 e28016a9d650ec40e7e53a0c17dbc5ad0c7af18f 828180 libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Checksums-Sha256: 
 be01780a7b7bf2531e065c8b783ab425d4fb03ab4d1b61386be7be636be913b3 2992 libxml2_2.9.4+dfsg1-2.1.dsc
 e71790a415e5d6b4a6490040d946d584fa79465571da3b186cc67b8f064cd104 28036 libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 a42c045e2edc5007b4b5bb0608ef59f6dd59faa7766de891ae780f9f2a2559ea 828180 libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Files: 
 adafe65e8fe3d1f22f4b4f81b35bfecb 2992 libs optional libxml2_2.9.4+dfsg1-2.1.dsc
 08fd0b330d3b53b6d5eac185fb2c9973 28036 libs optional libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 bc9ea1f1b544d7fadea851721c174282 828180 doc optional libxml2-doc_2.9.4+dfsg1-2.1_all.deb

-----BEGIN PGP SIGNATURE-----

iQKPBAEBCgB5BQJYFhObXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ0NjQ0NDA5ODA4QzE3MUUwNTUzMURERUUw
NTRDQjhGMzEzNDNDRjQ0EhxjYXJuaWxAZGViaWFuLm9yZwAKCRAFTLjzE0PPRL8q
D/4gV9gt4FkmQzYNlzznVJnx9cNcqgoZzi91H3Ap9vFpJy80XAJT1w32joBjINxu
boZuOV6Bo4rJt3zHHdprIlqYyAdKjxXIHHePAlFU8FutRPsU9EE76qeho/ovR/GT
Crq2YZatqXmvgJqzOMM3SSVOFw5WL9xbin8qiI69TPFAW4x6M2LDUAbSWze5ekHa
yhRvzuZHAvWlBAPCSkfLo02m1RNv4y1dr29hMRGkX9ZSW1fdSzXrhfodinMInUL2
aJBkmc+hU8wb5SSdwvQsHjjN1Xu55KqNWv9J8/XIddcsCAqzxqNFEc3tJL0l99yk
5S9wxSZAv1XOa3WXl5kgHtlr2zzqGIXiyeCP6HMmGhCVuzBMb2PdLQE4jYAD2q8O
U7zigLerh4aJiCl6JR1HbPyzptixdBQkdP/knoW7ZwvPFnf3k9oHl2GgFAD1M7L7
hRBx2H4TOTDN8vTu5NDRyNitU34SijEdI9C2pbUqXADOdxnn1Cjec8NgtaXQ7Anq
0qkVcj2Mkw5ppqdA/omP6I3grlthQT/nuNrBm/p58kMrKxlv6bhvjBL4qreHi8Q5
up1xrLTeBYiAtTXldBTjVx8HF5KgyjErE2tJgkaA3rlFJ2m40rb4ZHI8a+0OWT8G
XHj1Hxv3xzxsbAL76/xa7CdL3qyA25hy1FUxAgtBwdnqOQ==
=SiRy
-----END PGP SIGNATURE-----

Message #32 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: 840554@bugs.debian.org, 840553@bugs.debian.org

Subject: Fixes from 2.9.4+dfsg1-2.1 / 2.8.0+dfsg1-7+wheezy7

Date: Wed, 16 Nov 2016 14:54:54 +0100 (CET)

Hello Aron,

are you going to upload these fixes for jessie, too?
Do you need assistance?

Thanks,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Message #37 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Thorsten Glaser <t.glaser@tarent.de>, 840554@bugs.debian.org

Cc: 840553@bugs.debian.org

Subject: Re: Bug#840554: Fixes from 2.9.4+dfsg1-2.1 / 2.8.0+dfsg1-7+wheezy7

Date: Wed, 16 Nov 2016 15:02:45 +0100

Hi,

On Wed, Nov 16, 2016 at 02:54:54PM +0100, Thorsten Glaser wrote:
> Hello Aron,
> 
> are you going to upload these fixes for jessie, too?
> Do you need assistance?

FWIW, from security-team side I was planning to work on those after
2.9.4+dfsg1-2.1 was now exposed enought in unstable first (unless
Around wwanted to take over).

I have it though not yet finalized.

Regards,
Salvatore

Message #42 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 840554@bugs.debian.org, 840553@bugs.debian.org

Subject: Re: Bug#840554: Fixes from 2.9.4+dfsg1-2.1 / 2.8.0+dfsg1-7+wheezy7

Date: Wed, 16 Nov 2016 15:12:39 +0100 (CET)

On Wed, 16 Nov 2016, Salvatore Bonaccorso wrote:

> FWIW, from security-team side I was planning to work on those after
> 2.9.4+dfsg1-2.1 was now exposed enought in unstable first (unless

OK, thank you.

> I have it though not yet finalized.

No worries.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Message #47 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Thorsten Glaser <t.glaser@tarent.de>, 840554@bugs.debian.org

Cc: 840553@bugs.debian.org

Subject: Re: Bug#840554: Fixes from 2.9.4+dfsg1-2.1 / 2.8.0+dfsg1-7+wheezy7

Date: Sun, 11 Dec 2016 15:25:37 +0100

Hi

On Wed, Nov 16, 2016 at 03:12:39PM +0100, Thorsten Glaser wrote:
> On Wed, 16 Nov 2016, Salvatore Bonaccorso wrote:
> 
> > FWIW, from security-team side I was planning to work on those after
> > 2.9.4+dfsg1-2.1 was now exposed enought in unstable first (unless
> 
> OK, thank you.
> 
> > I have it though not yet finalized.
> 
> No worries.

FTR, as you might have seen, this has not yet happened. It is on my
"table", but a new issue arrised which I would like to check as well.
But it is still beeing discussed upstream.

Regards,
Salvatore

Message #52 received at 840554@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Thorsten Glaser <t.glaser@tarent.de>, 840553@bugs.debian.org

Cc: 840554@bugs.debian.org

Subject: Re: Bug#840553: Bug#840554: Fixes from 2.9.4+dfsg1-2.1 / 2.8.0+dfsg1-7+wheezy7

Date: Sat, 17 Dec 2016 19:55:12 +0100

Hi Thorsten,

On Wed, Nov 16, 2016 at 03:12:39PM +0100, Thorsten Glaser wrote:
> On Wed, 16 Nov 2016, Salvatore Bonaccorso wrote:
> 
> > FWIW, from security-team side I was planning to work on those after
> > 2.9.4+dfsg1-2.1 was now exposed enought in unstable first (unless
> 
> OK, thank you.
> 
> > I have it though not yet finalized.
> 
> No worries.

The upstream solution for CVE-2016-9318 seems still to get finalized,
and I do not want to rush things on this regard. So I went ahead and
finalized the debdiff for #840553, #840554 only.

If you want to give it a try, testpackages can be found at:

https://people.debian.org/~carnil/tmp/libxml2/

I'm still doing tests, to see I do not introduce any regression with
that upload.

Regards,
Salvatore

Message #59 received at 840554-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 840554-close@bugs.debian.org

Subject: Bug#840554: fixed in libxml2 2.9.1+dfsg1-5+deb8u4

Date: Sat, 24 Dec 2016 21:02:12 +0000

Source: libxml2
Source-Version: 2.9.1+dfsg1-5+deb8u4

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 840554@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 17 Dec 2016 19:42:58 +0100
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg libxml2-doc python-libxml2 python-libxml2-dbg
Architecture: all source
Version: 2.9.1+dfsg1-5+deb8u4
Distribution: jessie-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 840553 840554
Description: 
 libxml2    - GNOME XML library
 libxml2-dbg - Debugging symbols for the GNOME XML library
 libxml2-dev - Development files for the GNOME XML library
 libxml2-doc - Documentation for the GNOME XML library
 libxml2-utils - XML utilities
 libxml2-utils-dbg - XML utilities (debug extension)
 python-libxml2 - Python bindings for the GNOME XML library
 python-libxml2-dbg - Python bindings for the GNOME XML library (debug extension)
Changes:
 libxml2 (2.9.1+dfsg1-5+deb8u4) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix comparison with root node in xmlXPathCmpNodes
   * Fix XPointer paths beginning with range-to (CVE-2016-5131)
    (Closes: #840554)
   * Disallow namespace nodes in XPointer ranges (CVE-2016-4658)
     (Closes: #840553)
   * Fix more NULL pointer derefs in xpointer.c
Checksums-Sha1: 
 efa2de3e0b0661c49d703e910cbb6da3641e1e17 2760 libxml2_2.9.1+dfsg1-5+deb8u4.dsc
 e27c423442c4d8fc2aae872da630510e93fda912 66756 libxml2_2.9.1+dfsg1-5+deb8u4.debian.tar.xz
 04dff14d8a76e6eee670540c854b8af236130901 814770 libxml2-doc_2.9.1+dfsg1-5+deb8u4_all.deb
Checksums-Sha256: 
 23f9a9935227718fd2921abb484c129617325e1306d8525b3dcec1611df01096 2760 libxml2_2.9.1+dfsg1-5+deb8u4.dsc
 cda8374910db4e2a06b2515123dbe0b714f7f647532dc305f03c2a094175e706 66756 libxml2_2.9.1+dfsg1-5+deb8u4.debian.tar.xz
 077cae3381c2ebfe6537190bf9204d953c3c96ce181474f4027cc8ead9ba8fc4 814770 libxml2-doc_2.9.1+dfsg1-5+deb8u4_all.deb
Files: 
 f98c7d9f59e95b354ac6c443f0df4425 2760 libs optional libxml2_2.9.1+dfsg1-5+deb8u4.dsc
 baae4e43fa95061a79014dd525078545 66756 libs optional libxml2_2.9.1+dfsg1-5+deb8u4.debian.tar.xz
 3cb06339d607acd3d8a1e763ea3065d9 814770 doc optional libxml2-doc_2.9.1+dfsg1-5+deb8u4_all.deb

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlhViIdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E7pMQAJVMqx00hx6RhbQcovt/n1WQqXWPyVNC
htgz3lSelGZFkDe8nyeHDzw6Br5Q/u+kJetD3A7IaHGMXNsTVDh9r6mGAmJhsd4O
xx9snz2KcUmRwqMS53s78FRSlUjrO32klCD5x1kwPjcYwDSHMWerUU53I7n1enHj
K/g96ARB1cVxelqy2to785iRt6NFfbRRUz3c2J/SMSMAVZv0/6zEhsE+r6ccNTWC
X28mhmEC5wpD+MuLb/USyMp7uPt6SbvwSLX0dzQUaj/2yZ2b4eOxTgrQvmoxe1+8
3LQqep8FxlD0MBUp3pKbNsuMi6a6h7NV+jhbe0dovngNP+BjnTK+i+DZgwnO/9w3
vPvsRREBBvwrISZrTugB4zJazgaMfEI7+mo6EI49esV3qaPl+WZXz9azJZy6vI+0
3jQk6qNe40dtaWQCY3ZB/iaZpJF3K0xioBHVJwVF7sAiwGFq89l4nMp/8gGsL73i
2QcC9fSNj9MIjGTtfAle45jnY9oJU/oSKxzrKmNYY5pjzhNOs/8lGxgAi7bkSHBO
JlQ7wldIYRt6wqXQpnKdxalh9q+E3AYTDRO+uOOZHpIUUOR+qa8TP1EzYozfuDka
XWfJJioG4nnSkd9ySMZLIs+miorMih8SuZ3/q4XGpgcwCVDrx3YVeV0b/4TAj/2E
42EWYcTMuOzf
=u5sF
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.