| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20081117233404.GA3818@galadriel.inutil.org>
Date: Tue, 18 Nov 2008 00:34:04 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 1666-1] New libxml2 packages fix
several vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1666-1 security@...ian.org
http://www.debian.org/security/ Moritz Muehlenhoff
November 17, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : libxml2
Vulnerability : several
Problem type : local(remote)
Debian-specific: no
CVE Id(s) : CVE-2008-4225 CVE-2008-4226
Several vulnerabilities have been discovered in the GNOME XML library.
The Common Vulnerabilities and Exposures project identifies the
following problems:
CVE-2008-4225
Drew Yao discovered that missing input sanitising in the
xmlBufferResize() function may lead to an infinite loop,
resulting in denial of service.
CVE-2008-4226
Drew Yao discovered that an integer overflow in the
xmlSAX2Characters() function may lead to denial of service or
the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in
version 2.6.27.dfsg-6.
For the upcoming stable distribution (lenny) and the unstable
distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your libxml2 packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc
Size/MD5 checksum: 893 b6b2006ffadfb999e72974d574814b7c
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz
Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz
Size/MD5 checksum: 147867 d6a3bbbe39bffe96867de82b11c7c5be
Architecture independent packages:
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb
Size/MD5 checksum: 1328280 c2990030601040775b909c8ace076100
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb
Size/MD5 checksum: 881946 38629543e71a18f6007b8d61d0500e36
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb
Size/MD5 checksum: 821150 f14ee677bb7eac20cd65adef90af0f3c
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb
Size/MD5 checksum: 37972 d7757b07f8b0c69f9fd0a07a1598a3e3
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb
Size/MD5 checksum: 184750 020e5ca7663ee88695e1502c8e8af77c
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb
Size/MD5 checksum: 917020 f837c687d428d94559bf68e012bc0e02
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb
Size/MD5 checksum: 745790 94edf60cc7d02dd31a70376baf740958
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb
Size/MD5 checksum: 892010 a648a6d69a73593739035d78ed3c8436
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb
Size/MD5 checksum: 796410 9f38a5028c33f32cf1701535c1c37984
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb
Size/MD5 checksum: 36682 4de1bfa28b9361e462075451befbe66c
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb
Size/MD5 checksum: 184126 1aae3163d718d0c378203b7ea1a53a9b
arm architecture (ARM)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb
Size/MD5 checksum: 673236 cda6995615db6e74610d8a51607e85e4
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb
Size/MD5 checksum: 817602 c5f81e370d055ba14a40a64d3fbb6e9e
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb
Size/MD5 checksum: 34682 4b01403ce80c2949f31559e0eacc044b
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb
Size/MD5 checksum: 165284 f84251cc53fa6b67b7fb55f58dd47d5b
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb
Size/MD5 checksum: 742176 2e9e6cbbc777d49a99d8a6d98c5dc799
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb
Size/MD5 checksum: 858220 0f8cf389ab60a7639fac0f6499325995
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb
Size/MD5 checksum: 863998 2332655d5ec188cf038cf9fcab862d9f
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb
Size/MD5 checksum: 850370 6c600a26f96c3a3eea898821b0a63937
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb
Size/MD5 checksum: 36852 75d6a8790e01eacb3183e6f295542215
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb
Size/MD5 checksum: 192850 f635c62c33d9a2ea17015b08370dfd8f
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb
Size/MD5 checksum: 857246 6cebb1b5f8e5e87c00319eb59df9c497
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb
Size/MD5 checksum: 169026 31acf12efa0a8f37045f3f0869b894f8
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb
Size/MD5 checksum: 681544 f0f383f2ea6ae309bfbcd13f2a2e8efa
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb
Size/MD5 checksum: 756128 f776e4a0c28389602bb6b26965fc70ce
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb
Size/MD5 checksum: 34496 0cf1427860bb36162af23351285ff091
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb
Size/MD5 checksum: 196528 3eaa55301a20961852f3a3c5b64bde8c
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb
Size/MD5 checksum: 48494 280c616ff34b4aa41a48173828b6e66c
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb
Size/MD5 checksum: 1106616 e7b32b8f711337ca52a041af581a05b6
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb
Size/MD5 checksum: 1080448 a7334ed64dba73272b2001e09d18493f
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb
Size/MD5 checksum: 874194 1410e29414572197b6f82dd5a8be061f
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb
Size/MD5 checksum: 840690 ad2ce083ff5c14656ea3ae28b0fa783d
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb
Size/MD5 checksum: 770540 d1faeaa723c3de301fb4c8a44ece376a
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb
Size/MD5 checksum: 34424 c7c9469462957365ab26e7f06e1f0521
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb
Size/MD5 checksum: 171674 5e6f7cbe84d053bd19dda54346330f75
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb
Size/MD5 checksum: 926930 c4a3402711ebb05f38b1146eebcd0a71
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb
Size/MD5 checksum: 34396 79f5ff849d9a0ed01ab567ec542b7f3e
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb
Size/MD5 checksum: 898480 c195cceafe5efce1de168475a462be54
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb
Size/MD5 checksum: 769244 d0d36bff7e63adf76857166c3ed10daa
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb
Size/MD5 checksum: 168696 3667deae6585a788c4da731b4fc9383d
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb
Size/MD5 checksum: 833258 4b1612f79d4b9d1ce2d7086fbb8edbd0
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb
Size/MD5 checksum: 780124 0d2ed3ecc5a1e7a5ce3870fab1bcfc43
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb
Size/MD5 checksum: 172736 2011f174234c5e939cebeedc2fd9e707
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb
Size/MD5 checksum: 37662 94991d67033b1b921bb72e5d7bf2b844
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb
Size/MD5 checksum: 898080 321d90790cf68bc046b9b577e7986438
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb
Size/MD5 checksum: 771124 47b6d53839ea42f54ae6ad2b89594a26
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb
Size/MD5 checksum: 36368 fbc5505f4471c4c2fe6ad41903c5596f
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb
Size/MD5 checksum: 885484 ead63bcf342e568c9c338c2772ea4e0d
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb
Size/MD5 checksum: 750248 ed7465c981212e90fac94dc040ac6bb4
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb
Size/MD5 checksum: 185718 414512cb0af24a7c5e3622b75ef9b56f
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb
Size/MD5 checksum: 806342 0f85b6120fdba835eaf39d02b4a606d9
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb
Size/MD5 checksum: 34578 dd02c5498d378ee75330f8f93b2eb3a7
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb
Size/MD5 checksum: 781490 ecf288ea66fc19e8f9874b90884a888e
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb
Size/MD5 checksum: 713214 434a8a91f3a4acbfc3df2a2707acbbe0
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb
Size/MD5 checksum: 759786 83ba89269fd32296c48c8498e100372b
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb
Size/MD5 checksum: 176878 9840698d19580fe86bfc55a2347361e5
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkkh/toACgkQXm3vHE4uylrA7QCeOrg7IGAYqMSs1zh4r83vykT8
/wcAn15KByQrhQVyIVmYM92GvpOn0NJg
=0ZjW
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists