Looking in to this further, I think the file in question is xmlparse.c . Looking first at the official expat version in their cvs repo, this vulnerability has been fixed (see revision 1.164 to 1.166 http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&view=log ).
Looking at the changelog for this file in the simgear git, it was first added in 2000 and cleaned up slightly in 2002. I can't find the offending piece of code in the simgear version probably because it is just so old and thus very different to the current official version. This also means that I can't patch it directly without someones guidance. Does anyone know if this bug applies to the version of xmlparse.c included in simgear? Chris On Thu, 2010-07-29 at 18:51 +0100, Chris Baines wrote: > Hello, > > I am in the process of hopefully updating the simgear package for > Debian. Simgear as far as i am aware includes a copy of Expat, I am > trying to decide if this bug should be closed in the 2.0.0 release or > not http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937 . > > Does anyone know if the vulnerabilities corresponding to the CVE ID's > CVE-2009-3720 > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 ) and > CVE-2009-3560 > (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 ) have been > fixed in simgear 2.0.0? > > Thanks, > > Chris ------------------------------------------------------------------------------ The Palm PDK Hot Apps Program offers developers who use the Plug-In Development Kit to bring their C/C++ apps to Palm for a share of $1 Million in cash or HP Products. Visit us here for more details: http://p.sf.net/sfu/dev2dev-palm _______________________________________________ Flightgear-devel mailing list Flightgear-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/flightgear-devel
