REDHAT-BUG-2378690: Null Pointer Dereference
If a SoapVar instance is created with a fully qualified name larger than 2G, this will cause a NULL pointer dereference resulting in a segmentation fault, leading to a denial of service.
Libxml versions prior to 2.13 cannot correctly handle a call to xmlNodeSetName() with a name longer than 2G. It will leave the node object in an invalid state with a NULL name. This later causes a NULL pointer dereference when using the name during message serialization.
This can be exploited if a SoapVar is created with a fully qualified name that is longer than 2G. This would be possible if some application code uses a namespace prefix from an untrusted source like from a remote SOAP service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2378690?
The severity of REDHAT-BUG-2378690 is classified as medium with a rating of 4.
How do I fix REDHAT-BUG-2378690?
To fix REDHAT-BUG-2378690, upgrade to Libxml version 2.13 or later to avoid the null pointer dereference issue.
What type of vulnerability is REDHAT-BUG-2378690?
REDHAT-BUG-2378690 is a null pointer dereference vulnerability that can lead to a denial of service.
What causes the segmentation fault in REDHAT-BUG-2378690?
The segmentation fault in REDHAT-BUG-2378690 is caused by creating a SoapVar instance with a fully qualified name larger than 2G.
What impact does REDHAT-BUG-2378690 have?
The impact of REDHAT-BUG-2378690 is a denial of service due to a segmentation fault resulting from specific input conditions.