libxml2 vulnerability CVE-2016-9318

ostroproject / ostro-os-xt

Ostro OS XT

MIT License

18 stars 25 forks source link

libxml2 vulnerability CVE-2016-9318 #77

Open ipuustin opened 7 years ago

ipuustin commented 7 years ago

See https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 and https://bugzilla.gnome.org/show_bug.cgi?id=772726 . The initial CVSSv3 vulnerabiilty score is 7.8 (high).

ipuustin commented 7 years ago

libxml2 is a widely used component in the distribution (11 direct reverse dependencies), so it's difficult to estimate the vulnerability score. However, at least libsoup will parse network-provided xml files. It's safe to assume that the vulnerabilty score will be high. The fix to the bug appears to be still not merged to libxml2 git repository.