Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1216112 (CVE-2015-3451) - CVE-2015-3451 perl-XML-LibXML: "expand_entities" option was not preserved under some circumstances
Summary: CVE-2015-3451 perl-XML-LibXML: "expand_entities" option was not preserved und...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-3451
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1216114
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-04-28 14:02 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:20 UTC (History)
8 users (show)

Fixed In Version: perl-XML-LibXML 2.0119
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-07 00:01:21 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-04-28 14:02:26 UTC 
It was reported that perl-XML-LibXML did ignore "expand_entities" option in some circumstances, which could lead to sensitive information disclosure.
Original report and CVE request (reprodcuers are also available):
http://seclists.org/oss-sec/2015/q2/280
Comment 1 Vasyl Kaigorodov 2015-04-28 14:06:14 UTC 
Created perl-XML-LibXML tracking bugs for this issue:

Affects: fedora-all [bug 1216114]
Comment 2 Fedora Update System 2015-05-10 23:34:10 UTC 
perl-XML-LibXML-2.0119-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Kurt Seifried 2015-08-07 00:01:02 UTC 
Mitigations:

This issue only affects programs using this program in forms such as:

$parser = XML::LibXML->new

or 

$XML_DOC = $parser->load_xml

if you use the form:

$XML_DOC = XML::LibXML->load_xml

this vulnerability will not be exposed.
Comment 4 Kurt Seifried 2015-08-07 00:01:21 UTC 
Statement:

This issue affects the versions of perl-XML-LibXML as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Note You need to log in before you can comment on or make changes to this bug.