[SECURITY] libxml stack overflow issues

[Brian Thomason]

Need to fix multiple use-after-free flaws when parsing notation and enumeration attribute types, and also need to fix stack overflow when parsing root XML document element DTD definition.

[Brian Thomason (brian-thomason)]

No DSA or Debian bug available; Package no longer in Debian as of Lenny.

[Marc Deslauriers (mdeslaur)]

Brian, your debdiff seems to remove the security fix for CVE-2007-6284 that was added in 1:1.8.17-14.1.

Could you please submit a fixed debdiff, and re-subscribe ubuntu-security-sponsors. Thanks!

[Brian Thomason (brian-thomason)]

Doh! very sorry about that - forgot to remerge the other patch back in.

[Marc Deslauriers (mdeslaur)]

ACK for the updated debdiff. Packages are building now and will be published soon.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libxml - 1:1.8.17-14.1ubuntu0.1

---------------
libxml (1:1.8.17-14.1ubuntu0.1) hardy-security; urgency=low

  * SECURITY UPDATE: Fix parsing issues (LP: #604768)
  - modified parser.c: Fix multiple use-after-free flaws when parsing notation and
    enumeration attribute types, and fix stack overflow when parsing root XML
    document element DTD definition. Patch provided by Debian in Etch.
  - CVE-2009-2416
  - CVE-2009-2414
 -- Brian Thomason <email address hidden> Mon, 12 Jul 2010 15:26:51 -0400

[Steve Beattie (sbeattie)]

libxml was superceded by libxml2 in the intrepid cycle; closing out the development task on this. Thanks Brian!