full-disclosure - [ MDVSA-2012:109 ] libxslt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1StKyL-00055X-Jx@titan.mandriva.com>
Date: Mon, 23 Jul 2012 17:55:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2012:109 ] libxslt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2012:109
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libxslt
 Date    : July 23, 2012
 Affected: 2011., Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been discovered and corrected in libxslt:
 
 The XSL implementation in libxslt allows remote attackers to cause a
 denial of service (incorrect read operation) via unspecified vectors
 (CVE-2012-2825).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2825
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2011:
 5478c30ece46a9790270b60d7e596d97  2011/i586/libxslt1-1.1.26-4.2-mdv2011.0.i586.rpm
 1c36a1e2dbbce726b348bdfc7be0cf00  2011/i586/libxslt-devel-1.1.26-4.2-mdv2011.0.i586.rpm
 c6e1622a15d00cfb756552e6d460427d  2011/i586/python-libxslt-1.1.26-4.2-mdv2011.0.i586.rpm
 3a64731760598b368609c318c57d897f  2011/i586/xsltproc-1.1.26-4.2-mdv2011.0.i586.rpm 
 d5b59fa350c0a3b58b46ea7d0f2d77cf  2011/SRPMS/libxslt-1.1.26-4.2.src.rpm

 Mandriva Linux 2011/X86_64:
 cf3431f296bfb9ed3e819d996ece1285  2011/x86_64/lib64xslt1-1.1.26-4.2-mdv2011.0.x86_64.rpm
 f0b2203f52383de39d57acf2ef616e91  2011/x86_64/lib64xslt-devel-1.1.26-4.2-mdv2011.0.x86_64.rpm
 0bf58a5c43e2a00252abbcd9614ed249  2011/x86_64/python-libxslt-1.1.26-4.2-mdv2011.0.x86_64.rpm
 79b4f442e57ae917cc10f62496f7c157  2011/x86_64/xsltproc-1.1.26-4.2-mdv2011.0.x86_64.rpm 
 d5b59fa350c0a3b58b46ea7d0f2d77cf  2011/SRPMS/libxslt-1.1.26-4.2.src.rpm

 Mandriva Enterprise Server 5:
 9812c69006dc5f1a70343f9ddf6782fb  mes5/i586/libxslt1-1.1.24-3.2mdvmes5.2.i586.rpm
 9136b7990be6055a73b04442ca43c502  mes5/i586/libxslt-devel-1.1.24-3.2mdvmes5.2.i586.rpm
 449579ced2ab4f715ab7e7ff3285c311  mes5/i586/libxslt-proc-1.1.24-3.2mdvmes5.2.i586.rpm
 7bf549969ace3d5a4e00a2755f062dec  mes5/i586/python-libxslt-1.1.24-3.2mdvmes5.2.i586.rpm 
 36713ea60977852e9da45fcac1cd65fe  mes5/SRPMS/libxslt-1.1.24-3.2mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 c7a3d34d5f3690c98cf56e81dc19c11d  mes5/x86_64/lib64xslt1-1.1.24-3.2mdvmes5.2.x86_64.rpm
 cf4b8b1e4df4425a51cf0ffc593f5038  mes5/x86_64/lib64xslt-devel-1.1.24-3.2mdvmes5.2.x86_64.rpm
 1f00c1a5519ecb8e9d77c9a4bfd002bb  mes5/x86_64/libxslt-proc-1.1.24-3.2mdvmes5.2.x86_64.rpm
 d1b80cce3d860813a2deb3dd9210a26e  mes5/x86_64/python-libxslt-1.1.24-3.2mdvmes5.2.x86_64.rpm 
 36713ea60977852e9da45fcac1cd65fe  mes5/SRPMS/libxslt-1.1.24-3.2mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFQDUcimqjQ0CJFipgRAr6AAKDEE/LN+SMYOh664q7Cqt2mwvkWeACguH08
aWQk6J0i7d19MsDlSF3V2Ec=
=iUm3
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/