full-disclosure - [ MDVSA-2008:231 ] libxml2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1L2bKS-00052V-T6@titan.mandriva.com>
Date: Tue, 18 Nov 2008 17:54:00 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:231 ] libxml2


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2008:231
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libxml2
 Date    : November 18, 2008
 Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 Drew Yaro of the Apple Product Security Team found two flaws in
 libxml2.  The first is a denial of service flaw in libxml2's XML
 parser.  If an application linked against libxml2 were to process
 certain malformed XML content, it cause the application to enter an
 infinite loop (CVE-2008-4225).
 
 The second is an integer overflow that caused a heap-based buffer
 overflow in libxml2's XML parser.  If an application linked against
 libxml2 were to process certain malformed XML content, it could
 cause the application to crash or possibly execute arbitrary code
 (CVE-2008-4226).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4225
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4226
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 71a9b4c8f5248b988ca008c213196640  2008.0/i586/libxml2_2-2.6.30-1.5mdv2008.0.i586.rpm
 163076d3b60d4bf08174d0a270588021  2008.0/i586/libxml2-devel-2.6.30-1.5mdv2008.0.i586.rpm
 7b25013141a60bb5d858f5df395fa0bf  2008.0/i586/libxml2-python-2.6.30-1.5mdv2008.0.i586.rpm
 db1cd5648e65f1d0f91c17e5ea2eec03  2008.0/i586/libxml2-utils-2.6.30-1.5mdv2008.0.i586.rpm 
 7c3f9222ad55cfa0fb31817f32eb4985  2008.0/SRPMS/libxml2-2.6.30-1.5mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 67b39168175be18091dfb82cb024e513  2008.0/x86_64/lib64xml2_2-2.6.30-1.5mdv2008.0.x86_64.rpm
 c1240bde112946c6bd76cd70b949ad11  2008.0/x86_64/lib64xml2-devel-2.6.30-1.5mdv2008.0.x86_64.rpm
 df89b0508f0c0767c13e66af3d1c2036  2008.0/x86_64/libxml2-python-2.6.30-1.5mdv2008.0.x86_64.rpm
 fd8ba653d5ed001e6b2e1240576087e4  2008.0/x86_64/libxml2-utils-2.6.30-1.5mdv2008.0.x86_64.rpm 
 7c3f9222ad55cfa0fb31817f32eb4985  2008.0/SRPMS/libxml2-2.6.30-1.5mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 d1d556acfd6359e7b0744f5031debc4e  2008.1/i586/libxml2_2-2.6.31-1.4mdv2008.1.i586.rpm
 151a4fa3c3157fe5e1454bf731f6127e  2008.1/i586/libxml2-devel-2.6.31-1.4mdv2008.1.i586.rpm
 b751e039a46257e84f2e4fe4c3317073  2008.1/i586/libxml2-python-2.6.31-1.4mdv2008.1.i586.rpm
 718b49035deee4c364a6f57fee63e56f  2008.1/i586/libxml2-utils-2.6.31-1.4mdv2008.1.i586.rpm 
 42f39fe32cffebaf6131084eca88078e  2008.1/SRPMS/libxml2-2.6.31-1.4mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 a094032ece09aeaa09a3f2df2e6456a7  2008.1/x86_64/lib64xml2_2-2.6.31-1.4mdv2008.1.x86_64.rpm
 072e110afb79c6c30c75c575cdd1f5a6  2008.1/x86_64/lib64xml2-devel-2.6.31-1.4mdv2008.1.x86_64.rpm
 ef29f5cea22893d86c6a931314da13e3  2008.1/x86_64/libxml2-python-2.6.31-1.4mdv2008.1.x86_64.rpm
 418799ac3809b5a5f669934aa239785a  2008.1/x86_64/libxml2-utils-2.6.31-1.4mdv2008.1.x86_64.rpm 
 42f39fe32cffebaf6131084eca88078e  2008.1/SRPMS/libxml2-2.6.31-1.4mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 83880aaa23cb8733fe8f22994eb60307  2009.0/i586/libxml2_2-2.7.1-1.2mdv2009.0.i586.rpm
 2e0bef0124aa53ad92db2d0d405482d8  2009.0/i586/libxml2-devel-2.7.1-1.2mdv2009.0.i586.rpm
 7e876ac1082e4bae1636d5c14191523a  2009.0/i586/libxml2-python-2.7.1-1.2mdv2009.0.i586.rpm
 a59ed2ad792a6abb3f39e35f27c79e02  2009.0/i586/libxml2-utils-2.7.1-1.2mdv2009.0.i586.rpm 
 a559631e1c75f2f970a22afe32f5e5bd  2009.0/SRPMS/libxml2-2.7.1-1.2mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 feabb6613a0f1d0df75c4a57ed000494  2009.0/x86_64/lib64xml2_2-2.7.1-1.2mdv2009.0.x86_64.rpm
 43e173c2b5214d139e802674e4bc1fd1  2009.0/x86_64/lib64xml2-devel-2.7.1-1.2mdv2009.0.x86_64.rpm
 ecdb43a0277011f31d1bd228f1df080f  2009.0/x86_64/libxml2-python-2.7.1-1.2mdv2009.0.x86_64.rpm
 c7dc1480b3db4b0f10bc41061e9ca513  2009.0/x86_64/libxml2-utils-2.7.1-1.2mdv2009.0.x86_64.rpm 
 a559631e1c75f2f970a22afe32f5e5bd  2009.0/SRPMS/libxml2-2.7.1-1.2mdv2009.0.src.rpm

 Corporate 3.0:
 974d88697726c14617528f4ed84c5608  corporate/3.0/i586/libxml2-2.6.6-1.6.C30mdk.i586.rpm
 72f9e2fc81d89796c13300fefea98e99  corporate/3.0/i586/libxml2-devel-2.6.6-1.6.C30mdk.i586.rpm
 e5c6a6f29343d80767524408dd102862  corporate/3.0/i586/libxml2-python-2.6.6-1.6.C30mdk.i586.rpm
 72a18b737d538e2d230f08aca82b5c5e  corporate/3.0/i586/libxml2-utils-2.6.6-1.6.C30mdk.i586.rpm 
 8f6860070e152e5edaac7bfa86fc875f  corporate/3.0/SRPMS/libxml2-2.6.6-1.6.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 98b4b68e8aa4ce9a3e2060118153f439  corporate/3.0/x86_64/lib64xml2-2.6.6-1.6.C30mdk.x86_64.rpm
 33e2c8678bab516a5d48a6973e7b1cfe  corporate/3.0/x86_64/lib64xml2-devel-2.6.6-1.6.C30mdk.x86_64.rpm
 92eddeb37ff21bec085e6f54e44c88dd  corporate/3.0/x86_64/lib64xml2-python-2.6.6-1.6.C30mdk.x86_64.rpm
 1138b99907d100b83cdfffcfce35be4b  corporate/3.0/x86_64/libxml2-utils-2.6.6-1.6.C30mdk.x86_64.rpm 
 8f6860070e152e5edaac7bfa86fc875f  corporate/3.0/SRPMS/libxml2-2.6.6-1.6.C30mdk.src.rpm

 Corporate 4.0:
 60ec0660197f4aff533b41baa28bcf75  corporate/4.0/i586/libxml2-2.6.21-3.5.20060mlcs4.i586.rpm
 9b081c51f489920a806e1f220ec84093  corporate/4.0/i586/libxml2-devel-2.6.21-3.5.20060mlcs4.i586.rpm
 9170a2fc6453bb760a189a0ef43eea8b  corporate/4.0/i586/libxml2-python-2.6.21-3.5.20060mlcs4.i586.rpm
 f29d2ee1dc29c74afad720b82d07d632  corporate/4.0/i586/libxml2-utils-2.6.21-3.5.20060mlcs4.i586.rpm 
 574023fc66ddd864ba92102e82072f70  corporate/4.0/SRPMS/libxml2-2.6.21-3.5.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 76e14470992b30d82531480c8bdefe80  corporate/4.0/x86_64/lib64xml2-2.6.21-3.5.20060mlcs4.x86_64.rpm
 e03fef73317cee0661edcf9d3bcf2b00  corporate/4.0/x86_64/lib64xml2-devel-2.6.21-3.5.20060mlcs4.x86_64.rpm
 b245be7c27e1d4a6631e9de44a716ddd  corporate/4.0/x86_64/lib64xml2-python-2.6.21-3.5.20060mlcs4.x86_64.rpm
 5c3e8747a73062af824d70b83818e45a  corporate/4.0/x86_64/libxml2-utils-2.6.21-3.5.20060mlcs4.x86_64.rpm 
 574023fc66ddd864ba92102e82072f70  corporate/4.0/SRPMS/libxml2-2.6.21-3.5.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJIzXHmqjQ0CJFipgRAgtNAJ40LimLCYlxGCjTHtM6bCkshDIHSACgvafV
W4LARM7xlten6xCJYA69G6Q=
=s6JH
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/