This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1865351753814621391==
Content-Language: en-CA
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------PdTsVxwwwSkzF6fTlv8KM3zd"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------PdTsVxwwwSkzF6fTlv8KM3zd
Content-Type: multipart/mixed;
 boundary="------------c9RHrHlC2rhLAwKmkXdhBcfo";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <635f9bdf-4ee1-ee87-c89a-757f56a3814e@canonical.com>
Subject: [USN-5324-1] libxml2 vulnerability

--------------c9RHrHlC2rhLAwKmkXdhBcfo
Content-Type: text/plain; charset=UTF-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-5324-1
March 14, 2022

libxml2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

libxml2 could be made to crash or run programs if it opened a specially
crafted file.

Software Description:
- libxml2: GNOME XML library

Details:

It was discovered that libxml2 incorrectly handled certain XML files. An
attacker could use this issue to cause libxml2 to crash, resulting in a
denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libxml2                         2.9.12+dfsg-4ubuntu0.1
  libxml2-utils                   2.9.12+dfsg-4ubuntu0.1

Ubuntu 20.04 LTS:
  libxml2                         2.9.10+dfsg-5ubuntu0.20.04.2
  libxml2-utils                   2.9.10+dfsg-5ubuntu0.20.04.2

Ubuntu 18.04 LTS:
  libxml2                         2.9.4+dfsg1-6.1ubuntu1.5
  libxml2-utils                   2.9.4+dfsg1-6.1ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5324-1
  CVE-2022-23308

Package Information:
  https://launchpad.net/ubuntu/+source/libxml2/2.9.12+dfsg-4ubuntu0.1
  https://launchpad.net/ubuntu/+source/libxml2/2.9.10+dfsg-5ubuntu0.20.04.2
  https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-6.1ubuntu1.5

--------------c9RHrHlC2rhLAwKmkXdhBcfo--

--------------PdTsVxwwwSkzF6fTlv8KM3zd
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmIvJPkACgkQZWnYVadE
vpNMjQ//bPELrwE9Yoj7yZEHBkdo9sO7+BqGsRjXM1f16PayKhNVGJjjP4dGYoQP
PwNMKCFdax47kgxmwQ3V1tTbewMnFtIV3K5r7rg5lgzz1Kw4ltQg2VMPNxktxDkb
iK4/kIafJOvbdvqA1y6cDK6oZL1fwEEuP71KnUzk5WQypGyE6P3FXRtnmNEpqMNd
B3yERdUhK1wHERvAPc4xP27QOFjmcipDO+juXGCVDagZlYgrfZ7oAtT6pgZODSAK
niNhoa9r1RL3OWDBjSTgaiSvvJD5CrDUgf1cOb1ZXd0L/UMBtibngckKF8fkfKqI
19FnESPVh+bDWYJMeS5jxqhqZioKrM6A8jVhnIfIskuzBVyoygyEg6PkpgR2mfm2
uAb4xPkLM69RxR+452YVXco2aFETySmRq5aU8sb3GqZ6Yiib9QoejDOAE47Y7FoZ
NuTzwlEmzfS/nKYs/8UPLN2CD8tTP9xvPrpgGjVGlmup2mvmOMJRApy0CjUGmAq5
7f71++4fM3J3Hd/1JN3Yc+qIhChf5fiwTR3F0rEgFo3TCoklpi5ds37AJ8FDxlSK
4JTbRl0nJjVXjfJRasb4jp2yAVnv7EhvZMuRu9BTi5oSHBiy5BjfH91WvgmEiSAK
LgWdeT2ITtfKHPkfjIjmWSQmfwV7u7186uiA6HFMf6xGrviNVxI=
=cLQI
-----END PGP SIGNATURE-----

--------------PdTsVxwwwSkzF6fTlv8KM3zd--


--===============1865351753814621391==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============1865351753814621391==--