Two vulnerabilities have been reported in W3C Libwww, which potentially can be exploited by malicious people to cause a DoS (Denial of Service).

1) A boundary error exists in the "HTBoundary_put_block()" function when processing multipart MIME data. This can be exploited to cause an illegal memory access past the end of the input buffer via specially crafted multipart MIME data.

Successful exploitation can potentially cause an application that uses Libwww to crash.

2) An error in the included Expat XML Parser library can be exploited to cause a crash.

For more information:
SA36425

The vulnerabilities are reported in version 5.4.0. Other versions may also be affected.

Solution
Restrict use to process multipart MIME data from trusted sources only. Do not process untrusted XML content using the library.
Further details available in Customer Area

Provided and/or discovered by
1) Sam Varshavchik

Changelog
Further details available in Customer Area

Original Advisory
Red Hat Bugzilla:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=159597

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area