]> code.ossystems Code Review - openembedded-core.git/commit
libxml2: CVE-2018-14404
authorSinan Kaya <okaya@kernel.org>
Fri, 5 Oct 2018 00:39:07 +0000 (00:39 +0000)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Thu, 18 Oct 2018 10:08:45 +0000 (11:08 +0100)
commit06d7f9039b005c2112e28336ac1c30e5120ec815
treef46361933b2af9e302cd724514b24b759320e984
parent759290ed5fedc1ce10639b3584d4532d688ea714
libxml2: CVE-2018-14404

* CVE-2018-14404
A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval()
function of libxml2 when parsing invalid XPath expression. Applications processing
untrusted XSL format inputs with the use of libxml2 library may be vulnerable to
denial of service attack due to crash of the application.

Affects libxml <= 2.9.8

CVE: CVE-2018-14404
Ref: https://access.redhat.com/security/cve/cve-2018-14404

Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
meta/recipes-core/libxml/libxml2/CVE-2018-14404.patch [new file with mode: 0644]
meta/recipes-core/libxml/libxml2_2.9.7.bb