full-disclosure - [ MDVSA-2011:131 ] libxml

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1R0Wau-0002Nn-M5@titan.mandriva.com>
Date: Mon, 05 Sep 2011 12:40:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2011:131 ] libxml

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:131
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libxml
 Date    : September 5, 2011
 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in
 libxml/libxml2:
 
 Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x
 through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent
 attackers to cause a denial of service (crash) and possibly execute
 arbitrary code via a crafted XML file that triggers a heap-based
 buffer overflow when adding a new namespace node, related to handling
 of XPath expressions (CVE-2011-1944).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1944
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 91a56eed57c4c5334b06dfa08cbc71c3  2009.0/i586/libxml1-1.8.17-14.2mdv2009.0.i586.rpm
 4b302ddcc4ec729431381b55b2a7f0f5  2009.0/i586/libxml1-devel-1.8.17-14.2mdv2009.0.i586.rpm
 07da42454f8b366c4eaad9c3454c0169  2009.0/i586/libxml2_2-2.7.1-1.7mdv2009.0.i586.rpm
 2f1a7997a3b3d990beb1920958c5e653  2009.0/i586/libxml2-devel-2.7.1-1.7mdv2009.0.i586.rpm
 088b45969e6ed600061f1443d66b8e03  2009.0/i586/libxml2-python-2.7.1-1.7mdv2009.0.i586.rpm
 4388c61a1fd0e29253788b5b0ed50b9f  2009.0/i586/libxml2-utils-2.7.1-1.7mdv2009.0.i586.rpm 
 0832d7b58dff4e3bebe76f32e0c7ce99  2009.0/SRPMS/libxml-1.8.17-14.2mdv2009.0.src.rpm
 06353372b3a8416494b67dd4ee0f1124  2009.0/SRPMS/libxml2-2.7.1-1.7mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 a671a890dcfe6acb098b0ef93b3a7277  2009.0/x86_64/lib64xml1-1.8.17-14.2mdv2009.0.x86_64.rpm
 8bcf9273a93a4d2d8092b128a3ba9b6b  2009.0/x86_64/lib64xml1-devel-1.8.17-14.2mdv2009.0.x86_64.rpm
 ca24cc56951cdaad1e91e49aab41b1e0  2009.0/x86_64/lib64xml2_2-2.7.1-1.7mdv2009.0.x86_64.rpm
 cef2fec84782932f31a33e5ea03296d5  2009.0/x86_64/lib64xml2-devel-2.7.1-1.7mdv2009.0.x86_64.rpm
 9d9982274c97538eaea39f84a2e59348  2009.0/x86_64/libxml2-python-2.7.1-1.7mdv2009.0.x86_64.rpm
 52af9613cb44df27be47c9ed836f1a62  2009.0/x86_64/libxml2-utils-2.7.1-1.7mdv2009.0.x86_64.rpm 
 0832d7b58dff4e3bebe76f32e0c7ce99  2009.0/SRPMS/libxml-1.8.17-14.2mdv2009.0.src.rpm
 06353372b3a8416494b67dd4ee0f1124  2009.0/SRPMS/libxml2-2.7.1-1.7mdv2009.0.src.rpm

 Mandriva Linux 2010.1:
 fe18b539e7c96fd88579e468b61a998d  2010.1/i586/libxml1-1.8.17-16.1mdv2010.2.i586.rpm
 613776b0f23dc278ac80a5f55a4895c4  2010.1/i586/libxml1-devel-1.8.17-16.1mdv2010.2.i586.rpm
 48a053d4bd69449ad6b946e8c944b6db  2010.1/i586/libxml2_2-2.7.7-1.3mdv2010.2.i586.rpm
 2642e7a2bd1f5173581808b8639ce843  2010.1/i586/libxml2-devel-2.7.7-1.3mdv2010.2.i586.rpm
 8c438c598bee68ff0014e1d7bb0e2025  2010.1/i586/libxml2-python-2.7.7-1.3mdv2010.2.i586.rpm
 4b886076f75ff7e935fff0c0857fad50  2010.1/i586/libxml2-utils-2.7.7-1.3mdv2010.2.i586.rpm 
 1cd36384a94985bf4d162dc3c9600f07  2010.1/SRPMS/libxml-1.8.17-16.1mdv2010.2.src.rpm
 2667d2e2762160cc57742fec24ecb9fe  2010.1/SRPMS/libxml2-2.7.7-1.3mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 5ea2dfe12abf2f3eb7bee79de1ebeeca  2010.1/x86_64/lib64xml1-1.8.17-16.1mdv2010.2.x86_64.rpm
 17b07159ee11d98a4960f51d798c85f7  2010.1/x86_64/lib64xml1-devel-1.8.17-16.1mdv2010.2.x86_64.rpm
 0bb5a486250b26e842eba791d950037b  2010.1/x86_64/lib64xml2_2-2.7.7-1.3mdv2010.2.x86_64.rpm
 ca633e675ae7e47374cf08a4317b2a6e  2010.1/x86_64/lib64xml2-devel-2.7.7-1.3mdv2010.2.x86_64.rpm
 f86f1c06557db0dc16e9c91e3948f1b3  2010.1/x86_64/libxml2-python-2.7.7-1.3mdv2010.2.x86_64.rpm
 7643a6230845023113e69a8f8b6823e9  2010.1/x86_64/libxml2-utils-2.7.7-1.3mdv2010.2.x86_64.rpm 
 1cd36384a94985bf4d162dc3c9600f07  2010.1/SRPMS/libxml-1.8.17-16.1mdv2010.2.src.rpm
 2667d2e2762160cc57742fec24ecb9fe  2010.1/SRPMS/libxml2-2.7.7-1.3mdv2010.2.src.rpm

 Corporate 4.0:
 402c97c08d9bf2ba42d0504a8ff33005  corporate/4.0/i586/libxml1-1.8.17-8.2.20060mlcs4.i586.rpm
 985da139b830931af9722d0c5d312294  corporate/4.0/i586/libxml1-devel-1.8.17-8.2.20060mlcs4.i586.rpm
 43cec07af16e82483b6427b1b3b4332d  corporate/4.0/i586/libxml2-2.6.21-3.8.20060mlcs4.i586.rpm
 d57401514fed3d02a97c6e1f8de9c2ed  corporate/4.0/i586/libxml2-devel-2.6.21-3.8.20060mlcs4.i586.rpm
 62dc3d0c18468831cabb88f0df1ea876  corporate/4.0/i586/libxml2-python-2.6.21-3.8.20060mlcs4.i586.rpm
 9d13363c56340d67f12968961c89af02  corporate/4.0/i586/libxml2-utils-2.6.21-3.8.20060mlcs4.i586.rpm 
 22ce70e90f2719288405f1d4282c55ea  corporate/4.0/SRPMS/libxml-1.8.17-8.2.20060mlcs4.src.rpm
 26425f4e3d07a58f1b4827a783b6077b  corporate/4.0/SRPMS/libxml2-2.6.21-3.8.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 92ef0e8a9d2448cd24a85f4d7a35190b  corporate/4.0/x86_64/lib64xml1-1.8.17-8.2.20060mlcs4.x86_64.rpm
 bd6f5650ff6cde96c05c3f4c5a09440b  corporate/4.0/x86_64/lib64xml1-devel-1.8.17-8.2.20060mlcs4.x86_64.rpm
 6c05200933b04e0f0f71b7600de61189  corporate/4.0/x86_64/lib64xml2-2.6.21-3.8.20060mlcs4.x86_64.rpm
 6756b137efaebf0b1419520fc9902054  corporate/4.0/x86_64/lib64xml2-devel-2.6.21-3.8.20060mlcs4.x86_64.rpm
 cea73dd9d481f07246a0664b142dd45d  corporate/4.0/x86_64/lib64xml2-python-2.6.21-3.8.20060mlcs4.x86_64.rpm
 e2637f851df5fd149c5401417cb73896  corporate/4.0/x86_64/libxml2-utils-2.6.21-3.8.20060mlcs4.x86_64.rpm 
 22ce70e90f2719288405f1d4282c55ea  corporate/4.0/SRPMS/libxml-1.8.17-8.2.20060mlcs4.src.rpm
 26425f4e3d07a58f1b4827a783b6077b  corporate/4.0/SRPMS/libxml2-2.6.21-3.8.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 c03b908359fb7ef82e44dc59edc13b47  mes5/i586/libxml1-1.8.17-14.2mdvmes5.2.i586.rpm
 30267679811b29923781a45ae90190e7  mes5/i586/libxml1-devel-1.8.17-14.2mdvmes5.2.i586.rpm
 4241bca8cc29970da37cdffb2a8d6103  mes5/i586/libxml2_2-2.7.1-1.7mdvmes5.2.i586.rpm
 b32c170ab352b018752bd0c43b35bb94  mes5/i586/libxml2-devel-2.7.1-1.7mdvmes5.2.i586.rpm
 1e0d8a63466d2268dc282cf87124d47e  mes5/i586/libxml2-python-2.7.1-1.7mdvmes5.2.i586.rpm
 933577bbf7b4053a0fb464900fe33c9b  mes5/i586/libxml2-utils-2.7.1-1.7mdvmes5.2.i586.rpm 
 ec3cfda9b1d0a101c764f91144b705b2  mes5/SRPMS/libxml-1.8.17-14.2mdvmes5.2.src.rpm
 f202196d22e25ee400bc9cc8dc4fbc7e  mes5/SRPMS/libxml2-2.7.1-1.7mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 9436d1e3965fdf642d6dbec17fa341ad  mes5/x86_64/lib64xml1-1.8.17-14.2mdvmes5.2.x86_64.rpm
 c08042169fae24bc4e9df16374c8bb7e  mes5/x86_64/lib64xml1-devel-1.8.17-14.2mdvmes5.2.x86_64.rpm
 ad465eb0990cef9c184f5441d7e96494  mes5/x86_64/lib64xml2_2-2.7.1-1.7mdvmes5.2.x86_64.rpm
 5ac8d3dbb5a82432ade622003d2fc7f5  mes5/x86_64/lib64xml2-devel-2.7.1-1.7mdvmes5.2.x86_64.rpm
 89caf5e28075d8ab6c9267b9b3c24994  mes5/x86_64/libxml2-python-2.7.1-1.7mdvmes5.2.x86_64.rpm
 cf2f64221393aef59c831247eb43f5cb  mes5/x86_64/libxml2-utils-2.7.1-1.7mdvmes5.2.x86_64.rpm 
 ec3cfda9b1d0a101c764f91144b705b2  mes5/SRPMS/libxml-1.8.17-14.2mdvmes5.2.src.rpm
 f202196d22e25ee400bc9cc8dc4fbc7e  mes5/SRPMS/libxml2-2.7.1-1.7mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFOZHbtmqjQ0CJFipgRAqh2AKDqS5jbfqbrXff3BpiuK+J3SrnUGQCgprjv
wqYuPQPlDnvb61gW67APqQI=
=97Xc
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/