Bug 10869

Summary:	CVE-2016-9318 for libxml
Product:	[Build System, Metadata & Runtime] Security - Recipe Upgrade	Reporter:	Ismo Puustinen <ismo.puustinen>
Component:	security	Assignee:	Saul Wold <sgw>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Undecided	CC:	bluelightning, stephano
Version:	unspecified
Target Milestone:	---
Hardware:	x86
OS:	Multiple
Whiteboard:
OS type for building Yocto:	---	Type of Regression:	---
Verified:		Documentation change:	Don't know

Description Ismo Puustinen 2017-01-02 07:40:45 UTC

See https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 :

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.

Comment 1 Paul Eggleton 2017-09-27 22:54:12 UTC

The patch for this is in master, pyro and morty - can we mark this resolved?

Comment 2 Stephano Cetola 2018-02-02 20:40:20 UTC

Pyro:
0dd44c00e3b2fbc3befc3f361624a3a60161d979

Morty:
53c39f29578a4468e7f64a7403e77c28d951de6a