[ILUG] is libxml(2) insecure?
kenn at bluetree.ie
Fri Oct 29 09:49:55 IST 2004
> 3. Is the XML library a security risk? Would it be ok use it for
Fedora libxml2 security advisory:
If the config files are only editable by root anyway, then there
isn't any additional exposure. If a privileged process is
reading XML files generated by non-privileges users, then there
is the potential of a privilege-elevation attack (maybe not with
this particular vulnerability, but there could be others).
I'd say if you don't need the flexibility and structure of an
XML format, go with the simpler shell script setting env vars
More information about the ILUG