[Full-disclosure] CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

2012-03-24 Thread VSR Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 VSR Security Advisory http://www.vsecurity.com/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Advisory Name: libraptor - XXE in RDF/XML File Interpretation Release Da

Re: [Full-disclosure] CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

2012-03-27 Thread VSR Advisories
Hi Alexander, As a researcher, I find the distros list a useful resource to enable quick and simultaneous notification of many open source OS distributions. > When it became apparent that this was to be violated since one or two of > the affected upstreams wanted much more time, the reporter (T

Re: [Full-disclosure] CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected)

2012-03-28 Thread Solar Designer
Hi, As stated in the timeline below (thanks!), this issue was handled in part using the Openwall-hosted distros list (which currently notifies many Linux distro vendors, FreeBSD, and NetBSD/pkgsrc with PGP re-encryption to individual recipients): http://oss-security.openwall.org/wiki/mailing-list