An update that fixes 8 vulnerabilities is now available.
Description:
This is a LTSS rollup update for the libxml2 library that fixes various security issues.
*
CVE-2013-2877: parser.c in libxml2 allowed remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.
*
CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
*
CVE-2012-5134: Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.
*
CVE-2012-2807: Multiple integer overflows in libxml2 on 64-bit Linux platforms allowed remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
*
CVE-2011-3102: Off-by-one error in libxml2 allowed remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
*
CVE-2012-0841: libxml2 computed hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
*
CVE-2011-3919: A heap-based buffer overflow during decoding of entity references with overly long names has been fixed.
