drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in xerces-c
Name: |
Ausführen beliebiger Kommandos in xerces-c |
|
ID: |
DSA-4814-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian buster |
|
Datum: |
Do, 17. Dezember 2020, 08:44 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1311 |
|
Applikationen: |
Xerces-C++ |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4814-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond December 17, 2020 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : xerces-c CVE ID : CVE-2018-1311 Debian Bug : 947431
It was discovered that xerces-c, a validating XML parser library for C++, did not correctly scan DTDs. The use-after-free vulnerability resulting from this issue would allow a remote attacker to leverage a specially crafted XML file in order to crash the application or potentially execute arbitrary code. Please note that the patch fixing this issue comes at the expense of a newly introduced memory leak.
For the stable distribution (buster), this problem has been fixed in version 3.2.2+debian-1+deb10u1.
We recommend that you upgrade your xerces-c packages.
For the detailed security status of xerces-c please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xerces-c
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl/bBZQACgkQEL6Jg/PV nWQAVQgAidQ0lluHvaQwVsE82NY+pWaYDIBH+T23VKAhecLUmUJkB6SZy77FkG4f 36nHuZYm2W+a62OFTwRy3833+OZqgSw9Jdzr4756u5XDBiDRpOaDW99Ra68VJjZl gh4svlRKUy9LWxeJxgZWoH5HitxOMp56EtsofHk/gdIRP7rRqG6k+mTNSnjjY+GR wrYqfcuvyP3frP8KJGvm8bX4zlhg14w5WNbnj3pzbgUv0taCXonV/g3TFY/egEdj wdiXo/5jhCwTAHuhMO+HWIWKuBPRIzYi0lrw1vCJL7YHgbwULYkqyMV1FEVp1FPB H+HvGCQ7azQ4fAC2GH1x1UzqgxTKpw== =/MaF -----END PGP SIGNATURE-----
|
|
|
|