Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in libxml2
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in libxml2
ID: USN-3424-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 17.04
Datum: Di, 19. September 2017, 07:32
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9047
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048
Applikationen: libxml2

Originalnachricht


--===============8757704228643642708==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="ithag3edvo6ozsth"
Content-Disposition: inline


--ithag3edvo6ozsth
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inlin
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3424-1
September 19, 2017

libxml2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in libxml2.

Software Description:
- libxml2: GNOME XML library

Details:

It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)

It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)

It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)

Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)

Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)

Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
libxml2 2.9.4+dfsg1-2.2ubuntu0.1

Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.3

Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.10

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3424-1
CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047,
CVE-2017-9048, CVE-2017-9049, CVE-2017-9050

Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-2.2ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.3
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.10


--ithag3edvo6ozsth
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIcBAABCgAGBQJZwGq2AAoJEC8Jno0AXoH02yQP/RhcaDJLjIg1s50IPx6DkIOQ
Y7Wu92sslz3lBz0S+yl/BhgaQvkPpH0xaOGN/TAY8cw+/LBF8n+DTg4YAb0lI741
fo40TEC2qyIO9UK4i2nwr4/TkEvezO7vkPlqNZVs2ULsBbJ32rHZF0MpBEKAPKbM
hQ9aFWSKQUy0VwL6et5gDhGethUSZluz8OrWmo/y8JB+pTdeyc0YxFfZu/mMG+Ic
6/wSbuDSabE34CWYISnzWLgniA5f0heo4dq1Oi0izWhNd/96L+jpqpjsktp8Mt8h
859XGgU5KGs1LX83nbpyLhP5W/49Ll5MiefnQ37UrzQwHPTKF6F+hcTx/H62Cn8i
Geo0JqLZYINZ3VXvf2bdOjgj1JCUoJQlRXEW3fiVu5dxs6S/1fvKxDbRmhYkYzma
I+wZjRjfnm+dn14Q6nqsdpzCtTf/u5364Sb9hdo+4bsr3h8xA91O0D8fQX0iMPen
Mz2KEeUs/rvZu5TkETllUrq5yepdN6GateV0F34S09KE/fJzbkAzYy3+uaEPEo6k
uLvA5FQIvzrMp8CfZ3kUCICycEwxVX7ZI5YAZWMkAd36dVMyqMj11gKm6GorMQKm
TEvfUd/v9SH5Nd5Mw7GppLwTJhghQFviw8mlYlCvCu62Vqr82C45AuRDwQ3AjFlU
Uazqfe3dtqSBUsXdWcGi
=O4jX
-----END PGP SIGNATURE-----

--ithag3edvo6ozsth--


--===============8757704228643642708==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============8757704228643642708==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung