Bug 3580 - Security Advisory - libxml2 - CVE-2012-2871
Summary: Security Advisory - libxml2 - CVE-2012-2871
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 1.4
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: Future
Assignee: Li Wang
QA Contact:
URL:
Whiteboard: P3
Depends on:
Blocks:
 
Reported: 2012-12-13 05:39 UTC by Li Wang
Modified: 2013-02-28 19:26 UTC (History)
7 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Li Wang 2012-12-13 05:39:41 UTC 
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.Per:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2871