Bug 10869 - CVE-2016-9318 for libxml
Summary: CVE-2016-9318 for libxml
Status: RESOLVED FIXED
Alias: None
Product: Security - Recipe Upgrade
Classification: Build System, Metadata & Runtime
Component: security (show other bugs)
Version: unspecified
Hardware: x86 Multiple
: Undecided normal
Target Milestone: ---
Assignee: Saul Wold
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2017-01-02 07:40 UTC by Ismo Puustinen
Modified: 2018-02-02 20:40 UTC (History)
2 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ismo Puustinen 2017-01-02 07:40:45 UTC 
See https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 :

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Comment 1 Paul Eggleton 2017-09-27 22:54:12 UTC 
The patch for this is in master, pyro and morty - can we mark this resolved?
Comment 2 Stephano Cetola 2018-02-02 20:40:20 UTC 
Pyro:
0dd44c00e3b2fbc3befc3f361624a3a60161d979

Morty:
53c39f29578a4468e7f64a7403e77c28d951de6a