Raptor contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when processing XML external entities in certain XML components within an RDF document, which will disclose contents of arbitrary files to a context-dependent attacker.

Upgrade to version 2.0.7 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1026837
• CVE ID: 2012-0037 (see also: NVD)
• Secunia Advisory ID: 48479 48493 48494 48526 48529 48542 48649 49619 50692
• Bugtraq ID: 52681
• Vendor Specific News/Changelog Entry: http://librdf.org/raptor/RELEASE.html#rel2_0_7
  http://lists.opensuse.org/opensuse-updates/2012-03/msg00049.html
  http://lists.opensuse.org/opensuse-updates/2012-03/msg00052.html
  http://www.gentoo.org/security/en/glsa/glsa-201209-05.xml
  http://www.ubuntu.com/usn/usn-1480-1
  http://www.us.debian.org/security/2012/dsa-2438
  https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077708.html
  http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078242.html
  http://seclists.org/bugtraq/2012/Mar/123
  http://seclists.org/bugtraq/2012/Mar/137
• Vendor Specific Advisory URL: http://www.libreoffice.org/advisories/CVE-2012-0037/
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2012:061
  http://www.openwall.com/lists/oss-security/2012/03/27/4
  http://www.vsecurity.com/resources/advisory/20120324-1/
• RedHat RHSA: RHSA-2012:0410 RHSA-2012:0411

• Timothy D. Morgan - Virtual Security Research, LLC.