|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2021-3537: libxml2: python-libxml2-python: python-libxml2: libxml2-python: NULL pointer dereference in valid.c in xmlValidBuildAContentModel | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Gianluca Gabrielli <gianluca.gabrielli> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P3 - Medium | CC: | carlos.lopez, pmonrealgonzalez, smash_bz |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/283523/ | ||
| Whiteboard: | CVSSv3.1:SUSE:CVE-2021-3537:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) | ||
| Found By: | Security Response Team | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
PoC from https://gitlab.gnome.org/GNOME/libxml2/-/issues/243
PoC from https://gitlab.gnome.org/GNOME/libxml2/-/issues/243 PoC from https://gitlab.gnome.org/GNOME/libxml2/-/issues/244 |
||
|
Description
Gianluca Gabrielli
2021-05-06 07:34:30 UTC
Affected packages: - SUSE:Carwos:1/libxml2 2.9.7 - SUSE:SLE-11-SP1:Update/libxml2 2.7.6 - SUSE:SLE-12-SP2:Update/libxml2 2.9.4 - SUSE:SLE-15:Update/libxml2 2.9.7 - SUSE:SLE-11-SP1:Update/libxml2-python 2.7.6 - SUSE:SLE-12-SP2:Update/python-libxml2 2.9.4 - SUSE:SLE-15:Update/python-libxml2-python 2.9.7 - openSUSE:Factory/libxml2 2.9.10 Upstream patch [0]. [0] https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61.patch Created attachment 849195 [details] PoC from https://gitlab.gnome.org/GNOME/libxml2/-/issues/243 Reproducer: xmllint --recover --postvalid poc-243 Created attachment 849196 [details] PoC from https://gitlab.gnome.org/GNOME/libxml2/-/issues/244 Exactly the same results as from poc-243, reproducer: xmllint --recover --postvalid poc-244 Factory submission: https://build.opensuse.org/request/show/892031 Before the fix: Segmentation fault (core dumped) After the fix: ... output error : string is not in UTF-8 SUSE-SU-2021:1654-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1185408,1185409,1185410,1185698 CVE References: CVE-2021-3516,CVE-2021-3517,CVE-2021-3518,CVE-2021-3537 JIRA References: Sources used: SUSE MicroOS 5.0 (src): libxml2-2.9.7-3.34.1 SUSE Linux Enterprise Module for Python2 15-SP3 (src): python-libxml2-python-2.9.7-3.34.1 SUSE Linux Enterprise Module for Python2 15-SP2 (src): python-libxml2-python-2.9.7-3.34.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): libxml2-2.9.7-3.34.1, python-libxml2-python-2.9.7-3.34.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): libxml2-2.9.7-3.34.1, python-libxml2-python-2.9.7-3.34.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2021:14729-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1159928,1161517,1161521,1176179,1185408,1185409,1185410,1185698 CVE References: CVE-2014-0191,CVE-2019-19956,CVE-2019-20388,CVE-2020-24977,CVE-2020-7595,CVE-2021-3516,CVE-2021-3517,CVE-2021-3518,CVE-2021-3537 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): libxml2-2.7.6-0.77.36.1, libxml2-python-2.7.6-0.77.36.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): libxml2-2.7.6-0.77.36.1, libxml2-python-2.7.6-0.77.36.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): libxml2-2.7.6-0.77.36.1, libxml2-python-2.7.6-0.77.36.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): libxml2-2.7.6-0.77.36.1, libxml2-python-2.7.6-0.77.36.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2021:1658-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1185408,1185409,1185410,1185698 CVE References: CVE-2021-3516,CVE-2021-3517,CVE-2021-3518,CVE-2021-3537 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE OpenStack Cloud Crowbar 8 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE OpenStack Cloud 9 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE OpenStack Cloud 8 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server 12-SP5 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 HPE Helion Openstack 8 (src): libxml2-2.9.4-46.43.1, python-libxml2-2.9.4-46.43.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. openSUSE-SU-2021:0764-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1185408,1185409,1185410,1185698 CVE References: CVE-2021-3516,CVE-2021-3517,CVE-2021-3518,CVE-2021-3537 JIRA References: Sources used: openSUSE Leap 15.2 (src): libxml2-2.9.7-lp152.10.12.1, python-libxml2-python-2.9.7-lp152.10.12.1 Done, closing. |