CVE-2017-18926

raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples.

Security Fix(es):

• raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer (CVE-2017-18926)

• raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common (CVE-2020-25713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples.

Security Fix(es):

• raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer (CVE-2017-18926)

• raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common (CVE-2020-25713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for raptor fixes the following issues:

• Fixed a heap overflow vulnerability (bsc#1178593, CVE-2017-18926).

This update was imported from the SUSE:SLE-15:Update update project.

This update for raptor fixes the following issues:

• Fixed a heap overflow vulnerability (bsc#1178593, CVE-2017-18926).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libraptor-devel-2.0.15-3.8 package on the GA media of openSUSE Tumbleweed.

This update for raptor fixes the following issues:

• Fixed a heap overflow vulnerability (bsc#1178593, CVE-2017-18926).

This update for raptor fixes the following issues:

• Fixed a heap overflow vulnerability (bsc#1178593, CVE-2017-18926).
• Update raptor to version 2.0.15
  • Made several fixes to Turtle / N-Triples family of parsers and serializers
  • Added utility functions for re-entrant sorting of objects and sequences.
  • Made other fixes and improvements including fixing reported issues: 0000574, 0000575, 0000576, 0000577, 0000579, 0000581 and 0000584.

This update for raptor fixes the following issues:

• Fixed a heap overflow vulnerability (bsc#1178593, CVE-2017-18926).

Hanno Böck discovered that Raptor incorrectly handled certain memory operations. If a user were tricked into opening a specially crafted document in an application linked against Raptor, an attacker could cause the application to crash, resulting in a denial of service, or possibly execute arbitrary code.

Hanno Böck discovered that Raptor incorrectly handled memory operations when processing certain input files. An attacker could use this issue to cause Raptor to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-18926)

Hanno Böck discovered that Raptor incorrectly handled memory operations when processing certain input files. An attacker could possibly use this issue to cause Raptor to crash, resulting in a denial of service. (CVE-2020-25713)