CVE-2017-5130

An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.

Chromium-browser 62.0.3202.94 fixes security issues: Multiple flaws were found in the way Chromium 60 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122, CVE-2017-5124, CVE-2017-5125, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5130, CVE-2017-5131, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15389, CVE-2017-15390, CVE-2017-15391, CVE-2017-15392, CVE-2017-15393, CVE-2017-15394, CVE-2017-15395, CVE-2017-15396, CVE-2017-15398, CVE-2017-15399, CVE-2017-15406)

Use-after-free error could lead to crash (CVE-2016-4658).

Use-after-free vulnerability in libxml2 through 2.9.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function (CVE-2016-5131).

libxml2 2.9.4 and earlier does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document (CVE-2016-9318).

Heap buffer overflow in xmlAddID (CVE-2017-0663).

Integer overflow in memory debug code in libxml2 before 2.9.5 (CVE-2017-5130).

NULL pointer deref in xmlDumpElementContent (CVE-2017-5969).

Prevent unwanted external entity reference (CVE-2017-7375).

Increase buffer space for port in HTTP redirect support (CVE-2017-7376).

The function xmlSnprintfElementContent in valid.c was vulnerable to a stack buffer overflow (CVE-2017-9047, CVE-2017-9048).

The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-based buffer over-read (CVE-2017-9049).

The function xmlDictAddString was vulnerable to a heap-based buffer over-read (CVE-2017-9050).

It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service (CVE-2017-15412).

Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service (CVE-2017-16932).

The libxml2 package has been updated to version 2.9.7 to fix these issues and several other bugs.

Integer overflow in memory debug code in libxml2 before 2.9.5 (CVE-2017-5130).

It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service (CVE-2017-15412).

Wei Lei discovered that libxml2 incorrecty handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service (CVE-2017-16932).

The libxml2 package has been updated to version 2.9.7 to fix these issues and several other bugs.

Also, the perl-XML-LibXML package has been updated to version 2.13.200 to allow it to be rebuilt against the updated libxml2.

This update to Chromium 63.0.3239.84 fixes the following security issues:

• CVE-2017-5124: UXSS with MHTML
• CVE-2017-5125: Heap overflow in Skia
• CVE-2017-5126: Use after free in PDFium
• CVE-2017-5127: Use after free in PDFium
• CVE-2017-5128: Heap overflow in WebGL
• CVE-2017-5129: Use after free in WebAudio
• CVE-2017-5132: Incorrect stack manipulation in WebAssembly.
• CVE-2017-5130: Heap overflow in libxml2
• CVE-2017-5131: Out of bounds write in Skia
• CVE-2017-5133: Out of bounds write in Skia
• CVE-2017-15386: UI spoofing in Blink
• CVE-2017-15387: Content security bypass
• CVE-2017-15388: Out of bounds read in Skia
• CVE-2017-15389: URL spoofing in OmniBox
• CVE-2017-15390: URL spoofing in OmniBox
• CVE-2017-15391: Extension limitation bypass in Extensions.
• CVE-2017-15392: Incorrect registry key handling in PlatformIntegration
• CVE-2017-15393: Referrer leak in Devtools
• CVE-2017-15394: URL spoofing in extensions UI
• CVE-2017-15395: Null pointer dereference in ImageCapture
• CVE-2017-15396: Stack overflow in V8
• CVE-2017-15398: Stack buffer overflow in QUIC
• CVE-2017-15399: Use after free in V8
• CVE-2017-15408: Heap buffer overflow in PDFium
• CVE-2017-15409: Out of bounds write in Skia
• CVE-2017-15410: Use after free in PDFium
• CVE-2017-15411: Use after free in PDFium
• CVE-2017-15412: Use after free in libXML
• CVE-2017-15413: Type confusion in WebAssembly
• CVE-2017-15415: Pointer information disclosure in IPC call
• CVE-2017-15416: Out of bounds read in Blink
• CVE-2017-15417: Cross origin information disclosure in Skia
• CVE-2017-15418: Use of uninitialized value in Skia
• CVE-2017-15419: Cross origin leak of redirect URL in Blink
• CVE-2017-15420: URL spoofing in Omnibox
• CVE-2017-15422: Integer overflow in ICU
• CVE-2017-15423: Issue with SPAKE implementation in BoringSSL
• CVE-2017-15424: URL Spoof in Omnibox
• CVE-2017-15425: URL Spoof in Omnibox
• CVE-2017-15426: URL Spoof in Omnibox
• CVE-2017-15427: Insufficient blocking of JavaScript in Omnibox

The following tracked bug fixes are included:

• sandbox crash fixes (bsc#1064298)

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libxml2 fixes several issues.

Theses security issues were fixed:

• CVE-2017-16932: Fixed infinite recursion could lead to an infinite loop or memory exhaustion when expanding a parameter entity in a DTD (bsc#1069689).
• CVE-2017-15412: Prevent use after free when calling XPath extension functions that allowed remote attackers to cause DoS or potentially RCE (bsc#1077993)
• CVE-2016-5131: Use-after-free vulnerability in libxml2 allowed remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. (bsc#1078813)
• CVE-2017-5130: Fixed a potential remote buffer overflow in function xmlMemoryStrdup() (bsc#1078806)

This update for libxml2 fixes one issue.

This security issue was fixed:

• CVE-2017-15412: Prevent use after free when calling XPath extension functions that allowed remote attackers to cause DoS or potentially RCE (bsc#1077993)
• CVE-2016-5131: Use-after-free vulnerability in libxml2 allowed remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. (bsc#1078813)
• CVE-2017-5130: Fixed a potential remote buffer overflow in function xmlMemoryStrdup() (bsc#1078806)