BugTraq
[ MDVSA-2011:188 ] libxml2 Dec 15 2011 07:26PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:188
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libxml2
Date : December 15, 2011
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in libxml2:

Off-by-one error in libxml allows remote attackers to execute arbitrary
code or cause a denial of service (heap-based buffer overflow and
application crash) via a crafted web site CVE-2011-0216).

libxml2 allows remote attackers to cause a denial of service
(out-of-bounds read) via unspecified vectors (CVE-2011-3905).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3905
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
23ef99787f1b7ef3e64bc0762f3f3a4e 2010.1/i586/libxml2_2-2.7.7-1.5mdv2010.2.i586.rpm
feb02c6f36c8583a5bc2854f0433fe86 2010.1/i586/libxml2-devel-2.7.7-1.5mdv2010.2.i586.rpm
b706e84011c20d382a18a086894dca2b 2010.1/i586/libxml2-python-2.7.7-1.5mdv2010.2.i586.rpm
b963f6ab4f39336a51a0471de5c0a9da 2010.1/i586/libxml2-utils-2.7.7-1.5mdv2010.2.i586.rpm
dc474dd86bf91fbb13fcd8968a27194f 2010.1/SRPMS/libxml2-2.7.7-1.5mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
a61db16fd54c0fda75a5c0268d3524bd 2010.1/x86_64/lib64xml2_2-2.7.7-1.5mdv2010.2.x86_64.rpm
4f2fd97b4bbab696fae212559295516f 2010.1/x86_64/lib64xml2-devel-2.7.7-1.5mdv2010.2.x86_64.rpm
8064e2b0a5d5525c533be6cd61f20293 2010.1/x86_64/libxml2-python-2.7.7-1.5mdv2010.2.x86_64.rpm
d1aab22793a453e2fbaa6bc2c05b0de0 2010.1/x86_64/libxml2-utils-2.7.7-1.5mdv2010.2.x86_64.rpm
dc474dd86bf91fbb13fcd8968a27194f 2010.1/SRPMS/libxml2-2.7.7-1.5mdv2010.2.src.rpm

Mandriva Linux 2011:
8d0ea419886a45a7d2106d1f697fb0af 2011/i586/libxml2_2-2.7.8-6.3-mdv2011.0.i586.rpm
bbd914f659c2ea83a438eddcd3c31292 2011/i586/libxml2-devel-2.7.8-6.3-mdv2011.0.i586.rpm
9cc5144f6394ef736686b81087aea4a3 2011/i586/libxml2-python-2.7.8-6.3-mdv2011.0.i586.rpm
221cd5a0cef6bd5a651469811977dd1a 2011/i586/libxml2-utils-2.7.8-6.3-mdv2011.0.i586.rpm
f2683b77635f1ee49afff8cb8ad2e470 2011/SRPMS/libxml2-2.7.8-6.3.src.rpm

Mandriva Linux 2011/X86_64:
7a2de229452cbb4478f81a2a0c8f95f7 2011/x86_64/lib64xml2_2-2.7.8-6.3-mdv2011.0.x86_64.rpm
f7de6d69fe1b4da9cddafce53db848e5 2011/x86_64/lib64xml2-devel-2.7.8-6.3-mdv2011.0.x86_64.rpm
d90a089bcbcff95fd5db9b5a41eb0344 2011/x86_64/libxml2-python-2.7.8-6.3-mdv2011.0.x86_64.rpm
65b6d64de1c97b977d9b0264e9520623 2011/x86_64/libxml2-utils-2.7.8-6.3-mdv2011.0.x86_64.rpm
f2683b77635f1ee49afff8cb8ad2e470 2011/SRPMS/libxml2-2.7.8-6.3.src.rpm

Mandriva Enterprise Server 5:
d0c8c07632d01258639be4b038ab75d4 mes5/i586/libxml2_2-2.7.1-1.9mdvmes5.2.i586.rpm
d8e7605a3fb748bc7c5c0f577ffbe7b4 mes5/i586/libxml2-devel-2.7.1-1.9mdvmes5.2.i586.rpm
677c93e393fe0004d1a2e543e498555d mes5/i586/libxml2-python-2.7.1-1.9mdvmes5.2.i586.rpm
d9b1ba626d9514b26a3bf86719dfc62f mes5/i586/libxml2-utils-2.7.1-1.9mdvmes5.2.i586.rpm
c307b638da506db8346e1f790f39d772 mes5/SRPMS/libxml2-2.7.1-1.9mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
d8062c5526c39d22f819f2f70d104d2d mes5/x86_64/lib64xml2_2-2.7.1-1.9mdvmes5.2.x86_64.rpm
12eabde65491a7f6883247a27b239a97 mes5/x86_64/lib64xml2-devel-2.7.1-1.9mdvmes5.2.x86_64.rpm
728ad366c8f67640a50b6bb6f7260684 mes5/x86_64/libxml2-python-2.7.1-1.9mdvmes5.2.x86_64.rpm
f91719adff8bc425c66930f5d0aa81a3 mes5/x86_64/libxml2-utils-2.7.1-1.9mdvmes5.2.x86_64.rpm
c307b638da506db8346e1f790f39d772 mes5/SRPMS/libxml2-2.7.1-1.9mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFO6hv4mqjQ0CJFipgRAuEiAJ9pawfaABlHvmfJ09uDgpCeLNpgewCg5JCF
0fNH1rrHGgpcLTBb8rTOo8Y=
=ulBu
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus