New issue
Advanced search Search tips

Issue 824102 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , iOS , Chrome , Mac , Fuchsia
Pri: 1
Type: Bug-Security



Sign in to add a comment

Chromium: Vulnerability reported in libxml

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Mar 21 2018

Issue description

Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: libxml
Package Version: [cpe:/a:xmlsoft:libxml2:2.7.7]


Advisory: CVE-2017-7376
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2017-7376
  CVSS severity score: 10/10.0
  Confidence: high
  Description:

Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.


 
Components: Blink>XML
The patch linked in the CVE appears to already be in the Chromium code:

https://cs.chromium.org/chromium/src/third_party/libxml/src/uri.c?l=337&rcl=9b372f0758ed81655b5b33e949d418672b9e8cd1


Comment 2 by cthomp@chromium.org, Mar 21 2018

Labels: Security_Severity-High OS-Android OS-Chrome OS-Fuchsia OS-iOS OS-Linux OS-Mac OS-Windows
Status: Fixed (was: Unconfirmed)
The fix in uri.c (looking at the Android fix https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4%5E%21/#F0) does appear to have been included in https://chromium.googlesource.com/chromium/src/+log/52bfd9b23ead461185b20736e216a73cad1864fe/third_party/libxml/src/uri.c (dating to last April).

Looking at the vomit reference to the libxml2 commit indicates a different patch in nanohttp.c, which we also appear to already have patched:
Looking at https://cs.chromium.org/chromium/src/third_party/libxml/src/nanohttp.c?l=1432

It looks like we picked up the nanohttp.c fix in our roll last April:

https://chromium.googlesource.com/chromium/src/+/01618a2e9695f739ea089db2d7b1a3f4ccd5048c

As we appear to include both the Android patch as well as the upstream fix, I'm going mark this as Fixed.
Project Member

Comment 3 by sheriffbot@chromium.org, Mar 22 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 4 by sheriffbot@chromium.org, Jun 28 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment