Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Mehrere Probleme in libxml2
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in libxml2
ID: USN-2994-1
Distribution: Ubuntu
Plattformen: Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 15.10, Ubuntu 16.04 LTS
Datum: Mo, 6. Juni 2016, 22:39
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1840
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1834
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1837
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1833
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3627
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3705
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1835
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============4269773976963861255==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="wrGUDtsE57BVnwbrhJwGNFEcTwUARUjbj"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--wrGUDtsE57BVnwbrhJwGNFEcTwUARUjbj
Content-Type: multipart/mixed;
boundary="GcCVrpn8VP3s63JD4xdWPXQGXpUC0eDkw"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <5755B7E3.5040103@canonical.com>
Subject: [USN-2994-1] libxml2 vulnerabilities

--GcCVrpn8VP3s63JD4xdWPXQGXpUC0eDkw
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2994-1
June 06, 2016

libxml2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS
- Ubuntu 15.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in libxml2.

Software Description:
- libxml2: GNOME XML library

Details:

It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,
CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)

It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-1762, CVE-2016-1834)

Mateusz Jurczyk discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)

Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1835, CVE-2016-1837)

Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and
Ubuntu 16.04 LTS. (CVE-2016-1836)

Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1840)

It was discovered that libxml2 would load certain XML external entities. If
a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. (CVE-2016-4449)

Gustavo Grieco discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.1

Ubuntu 15.10:
libxml2 2.9.2+zdfsg1-4ubuntu0.4

Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.8

Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.15

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2994-1
CVE-2015-8806, CVE-2016-1762, CVE-2016-1833, CVE-2016-1834,
CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,
CVE-2016-1839, CVE-2016-1840, CVE-2016-2073, CVE-2016-3627,
CVE-2016-3705, CVE-2016-4447, CVE-2016-4449, CVE-2016-4483

Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.2+zdfsg1-4ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.8
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.15



--GcCVrpn8VP3s63JD4xdWPXQGXpUC0eDkw--

--wrGUDtsE57BVnwbrhJwGNFEcTwUARUjbj
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJXVbfmAAoJEGVp2FWnRL6TMGAP/1Ouz3CwxCVKrxAETopcvzT5
4ozan1DJorPwr3p1KKhWLUWK5oack2PtvIeLQ4Pf0Cj4hhfwO0gobF+crbyRR6mQ
TjgHXUc96s7kIpZn5O9E+VeIo6a2iK2UQYDMQm7SGDKJX8mmb7gzxrb9m+Z7If/Z
WS2QU6fEXByPEUMgQG2bgY33Ppniltxxi640WK4qvLlWOLBNUT9Y5sDzzSHNA5Tb
rGKfZVV2vHYOFG0oyCx24hL7aca/Tak7+iIQS/9xBpodr+bCHJphjXRJXN9oyca7
lLvW2X18t/bnVef8lPTXOcowH1zliVBXuuVCUBUdht3nZsQEmtykQ1GIFuJCJm4/
wymYYZ/zHy5memTp+uTf8keKmhz0s5UV421pK4zkAo2wXX2NW6uczUa4b6s68+Dw
rEHDbbQeVbxBlMr9RS54J3mWdLyV9J4tijPU4e4MmSi8udkBWBBc6y+4vnAB7kSo
r/cgQd1ULuJLiEv/L4nrzMqa3O7taQNwSHlvY5xHYWWPCuph/DVsjXPTavmIMaiF
InLZFV86FHFkyEYEknW1vxpt9dJfU+TswzBuQLDi+KqbO/OAzAARmY6ajU2FJNR7
s14D7tNIvPIjFkuUX50sSfLBoRCaxolRr3G5kBNJ51SH7/TKOLgVOwS2Pw3CTp+Y
NOwPPV2xjxb6LwStUgh1
=OT5F
-----END PGP SIGNATURE-----

--wrGUDtsE57BVnwbrhJwGNFEcTwUARUjbj--


--===============4269773976963861255==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============4269773976963861255==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung