REDHAT-BUG-2494191: Buffer Overflow
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.
This issue has been fixed in the commit c2e233fc.
NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Patch c2e233fc
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects use of the xmlcatalog utility in --shell mode. The vulnerable input handling is in the usershell() function.
What would an attacker need to do to trigger the flaw?
An attacker would need to supply an overly long input line to xmlcatalog while it is running in --shell mode. The oversized line can overflow fixed-size command, argument, and argv stack buffers during parsing.
What can be done before an update is available?
Avoid running xmlcatalog in --shell mode with untrusted input. The issue is fixed by commit c2e233fc.