----- Original Message ----
From: Chris Baines <cbain...@gmail.com>
To: FlightGear developers discussions <flightgear-devel@lists.sourceforge.net>
Sent: Fri, July 30, 2010 12:54:56 AM
Subject: Re: [Flightgear-devel] Expat CVE-2009-3720 and CVE-2009-3560
Looking in to this further, I think the file in question is xmlparse.c .
Looking first at the official expat version in their cvs repo, this
vulnerability has been fixed (see revision 1.164 to 1.166
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&view=log
).
Looking at the changelog for this file in the simgear git, it was first
added in 2000 and cleaned up slightly in 2002. I can't find the
offending piece of code in the simgear version probably because it is
just so old and thus very different to the current official version.
This also means that I can't patch it directly without someones
guidance. Does anyone know if this bug applies to the version of
xmlparse.c included in simgear?
Chris
On Thu, 2010-07-29 at 18:51 +0100, Chris Baines wrote:
> Hello,
>
> I am in the process of hopefully updating the simgear package for
> Debian. Simgear as far as i am aware includes a copy of Expat, I am
> trying to decide if this bug should be closed in the 2.0.0 release or
> not http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560937 .
>
> Does anyone know if the vulnerabilities corresponding to the CVE ID's
> CVE-2009-3720
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 ) and
> CVE-2009-3560
> (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720 ) have been
> fixed in simgear 2.0.0?
>
> Thanks,
>
> Chris
------------------------------------------------------------------------------
The Palm PDK Hot Apps Program offers developers who use the
Plug-In Development Kit to bring their C/C++ apps to Palm for a share
of $1 Million in cash or HP Products. Visit us here for more details:
http://p.sf.net/sfu/dev2dev-palm
_______________________________________________
Flightgear-devel mailing list
Flightgear-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/flightgear-devel
------------------------------------------------------------------------------
The Palm PDK Hot Apps Program offers developers who use the
Plug-In Development Kit to bring their C/C++ apps to Palm for a share
of $1 Million in cash or HP Products. Visit us here for more details:
http://p.sf.net/sfu/dev2dev-palm
_______________________________________________
Flightgear-devel mailing list
Flightgear-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/flightgear-devel
