https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Bug ID: 1524585 Summary: CVE-2016-4216 xmpcore: XXE resulting in information disclosure Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: anemec@redhat.com CC: alazarot@redhat.com, anstephe@redhat.com, cedric.olivier@free.fr, etirelli@redhat.com, felias@redhat.com, hchiorea@redhat.com, ibek@redhat.com, java-sig-commits@lists.fedoraproject.org, jcoleman@redhat.com, jolee@redhat.com, kverlaen@redhat.com, lpetrovi@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pavelp@redhat.com, pszubiak@redhat.com, puntogil@libero.it, rrajasek@redhat.com, rsynek@redhat.com, rzhang@redhat.com, sdaley@redhat.com, vhalbert@redhat.com
XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
External References:
https://helpx.adobe.com/security/products/xmpcore/apsb16-24.html
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1524586, 1524587
--- Comment #1 from Andrej Nemec anemec@redhat.com --- Created xmpcore tracking bugs for this issue:
Affects: epel-7 [bug 1524587] Affects: fedora-all [bug 1524586]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1524586 [Bug 1524586] CVE-2016-4216 xmpcore: XXE resulting in information disclosure [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1524587 [Bug 1524587] CVE-2016-4216 xmpcore: XXE resulting in information disclosure [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1524588
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jstastny@redhat.com Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0712,reported=20171210,sour |0712,reported=20171209,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:H/I:N/A:N,cwe=CWE-611,fe |/C:H/I:N/A:N,cwe=CWE-611,fe |dora-all/xmpcore=affected,e |dora-all/xmpcore=affected,e |pel-7/xmpcore=affected,bpms |pel-7/xmpcore=affected,bpms |-6/xmpcore=new,brms-6/xmpco |-6/xmpcore=new,brms-6/xmpco |re=new,jdv-6/xmpcore=new |re=new,jdv-6/xmpcore=affect | |ed
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0712,reported=20171209,sour |0712,reported=20171208,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:H/I:N/A:N,cwe=CWE-611,fe |/C:H/I:N/A:N,cwe=CWE-611,fe |dora-all/xmpcore=affected,e |dora-all/xmpcore=affected,e |pel-7/xmpcore=affected,bpms |pel-7/xmpcore=affected,bpms |-6/xmpcore=new,brms-6/xmpco |-6/xmpcore=affected,brms-6/ |re=new,jdv-6/xmpcore=affect |xmpcore=affected,jdv-6/xmpc |ed |ore=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1524614, 1524613
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Marek Novotny mnovotny@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |anemec@redhat.com, | |mnovotny@redhat.com Flags| |needinfo?(anemec@redhat.com | |)
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Marek Novotny mnovotny@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(anemec@redhat.com | |) |
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Pavel Polischouk pavelp@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0712,reported=20171208,sour |0712,reported=20171207,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:H/I:N/A:N,cwe=CWE-611,fe |/C:H/I:N/A:N,cwe=CWE-611,fe |dora-all/xmpcore=affected,e |dora-all/xmpcore=affected,e |pel-7/xmpcore=affected,bpms |pel-7/xmpcore=affected,bpms |-6/xmpcore=affected,brms-6/ |-6/xmpcore=wontfix,brms-6/x |xmpcore=affected,jdv-6/xmpc |mpcore=wontfix,jdv-6/xmpcor |ore=affected |e=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1524585
Ondrej Soukup osoukup@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016 |0712,reported=20171207,sour |0712,reported=20171210,sour |ce=internet,cvss3=7.5/CVSS: |ce=internet,cvss3=7.5/CVSS: |3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U |/C:H/I:N/A:N,cwe=CWE-611,fe |/C:H/I:N/A:N,cwe=CWE-611,fe |dora-all/xmpcore=affected,e |dora-all/xmpcore=affected,e |pel-7/xmpcore=affected,bpms |pel-7/xmpcore=affected,bpms |-6/xmpcore=wontfix,brms-6/x |-6/xmpcore=wontfix,brms-6/x |mpcore=wontfix,jdv-6/xmpcor |mpcore=wontfix,jdv-6/xmpcor |e=affected |e=affected
java-sig-commits@lists.fedoraproject.org