Bug 979208 – VUL-0: CVE-2016-2099: xerces: use-after-free in Xerces 3.1.3

Bug 979208 - (CVE-2016-2099) VUL-0: CVE-2016-2099: xerces: use-after-free in Xerces 3.1.3

(CVE-2016-2099)
Summary:	VUL-0: CVE-2016-2099: xerces: use-after-free in Xerces 3.1.3

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/168774/
Whiteboard:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2016-05-10 08:10 UTC by Sebastian Krahmer
Modified:	2017-10-26 05:42 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sebastian Krahmer 2016-05-10 08:10:27 UTC

CVE-2016-2099



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2099
http://seclists.org/oss-sec/2016/q2/286

Comment 1 Sebastian Krahmer 2016-05-10 08:16:04 UTC

Seems we dont ship an affected version?

Comment 3 Přemysl Janouch 2016-05-10 09:18:43 UTC

@Sebastian We do ship vulnerable versions, package is xerces-c.

Comment 4 Swamp Workflow Management 2016-05-10 22:00:24 UTC

bugbot adjusting priority

Comment 6 Bernhard Wiedemann 2016-06-16 16:00:41 UTC

This is an autogenerated message for OBS integration:
This bug (979208) was mentioned in
https://build.opensuse.org/request/show/402770 42.1 / xerces-c
https://build.opensuse.org/request/show/402771 13.2 / xerces-c
https://build.opensuse.org/request/show/402776 42.1 / xerces-c

Comment 10 Bernhard Wiedemann 2016-06-16 18:00:19 UTC

This is an autogenerated message for OBS integration:
This bug (979208) was mentioned in
https://build.opensuse.org/request/show/402777 13.2 / xerces-c

Comment 11 Bernhard Wiedemann 2016-06-24 12:00:22 UTC

This is an autogenerated message for OBS integration:
This bug (979208) was mentioned in
https://build.opensuse.org/request/show/404478 13.2 / xerces-c

Comment 13 Bernhard Wiedemann 2016-07-05 14:00:42 UTC

This is an autogenerated message for OBS integration:
This bug (979208) was mentioned in
https://build.opensuse.org/request/show/406725 Factory / xerces-c
https://build.opensuse.org/request/show/406726 13.2 / xerces-c

Comment 14 Swamp Workflow Management 2016-07-05 18:09:51 UTC

openSUSE-SU-2016:1744-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 979208
CVE References: CVE-2016-2099
Sources used:
openSUSE 13.2 (src):    xerces-c-3.1.1-13.6.1

Comment 15 Swamp Workflow Management 2016-07-15 13:08:58 UTC

openSUSE-SU-2016:1808-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 979208,985860
CVE References: CVE-2016-0729,CVE-2016-2099,CVE-2016-4463
Sources used:
openSUSE 13.2 (src):    xerces-c-3.1.4-13.9.2

Comment 16 Swamp Workflow Management 2016-08-25 14:09:07 UTC

SUSE-SU-2016:2154-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 979208,985860
CVE References: CVE-2016-2099,CVE-2016-4463
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    xerces-c-3.1.1-12.3
SUSE Linux Enterprise Server 12-SP1 (src):    xerces-c-3.1.1-12.3
SUSE Linux Enterprise Desktop 12-SP1 (src):    xerces-c-3.1.1-12.3

Comment 17 Swamp Workflow Management 2016-09-04 12:08:38 UTC

openSUSE-SU-2016:2232-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 979208,985860
CVE References: CVE-2016-2099,CVE-2016-4463
Sources used:
openSUSE Leap 42.1 (src):    xerces-c-3.1.1-19.1

Comment 18 Marcus Meissner 2017-10-26 05:42:56 UTC

released