1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 3057-2] libxml2 regression update

    From Salvatore Bonaccorso@1:229/2 to All on Tue Apr 7 21:00:02 2015
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3057-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso
    April 07, 2015 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : libxml2
    Debian Bug : 774358

    The update for libxml2 issued as DSA-3057-1 caused regressions due to an incomplete patch to address CVE-2014-3660. Updated packages are
    available to address this problem. For reference the original advisory
    text follows.

    Sogeti found a denial of service flaw in libxml2, a library providing
    support to read, modify and write XML and HTML files. A remote attacker
    could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption
    (denial of service) based on excessive entity substitutions, even if
    entity substitution was disabled, which is the parser default behavior. (CVE-2014-3660)

    For the stable distribution (wheezy), this problem has been fixed in
    version 2.8.0+dfsg1-7+wheezy4.

    We recommend that you upgrade your libxml2 packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQIcBAEBCgAGBQJVJCi+AAoJEAVMuPMTQ89EwvoQAJ3XjEknlEmqjvr6N+W45k4A R1F/51r1M17GpqFmhrnqcHTa0nTFgrQhcNgkKfF68GFrjr/jKyoC0HKjbwFl6j6a Zx0KrcWn39e/oM9DFYV9fcfkQKwsVQPqYsvp4PKVxMKRGLE7Ke21OYQdHxtUxYDy HHL2mlgMWe/k5+T9qvJZVFe6HZrleIkGP8SSWkzQbFKOVBIJk2RyVrbUrxHmUi+j KjhJBf+6VgT62+YprJGLtgPN/nitqoF9Zfk3qT2sgDyPAkdHV26S1vAPrlPK5KTN CwxcfZQShcQiQOsV3If6InSG97evAsMV3TbxAwaPBUTxNCLf07Z40Zlbvf7XvXyg apJ4TmV2cDY1f2g9hfHxgLwt8FWSosrZbrQi4a0QMFIb8Idf4YTOobDjy2kNio9l IrFumsvX1+tSdPYOOq37qKhfkRT4L0+aPsHOAn/6lfOz5DSGATvJ17yHvjYUnq2w 2gWE0VzOYG+iz8DtuJb79GvHUZGgbKjOMOCSbTa8udSQ+Ez6YjdgsGTw+PxIsF4h CxgFlQUOhozoGwZ5ryodBLWLPk38SDD/DAeGicSz87ZxIr2T6JLV+vFBEh0xTiJ4 Q4qPcxDCJrzUKmUkTSyCuBill4S9yz2NmbSIou9qdxF2r186S5YJqCUhlXAoTNF+ 6PqavMqfFYzb1VtDBjZ/
    =b9Wb
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)
  • From Ximena Cardinali@1:229/2 to All on Wed Apr 8 11:40:03 2015
    XPost: linux.debian.security
    From: [email protected]

    Erledigt auf:

    libxml2 (2.8.0+dfsg1-7+wheezy4) -> xdev.office, test01.office, ms1, malikdeb, ralf2.office, fthomas.office, dns01, devel, web3, confluence, syslog01, rancid, stor2b, svn01, jobserver, db1, git, kvmmgr, mx01, post01, postnl, pmaster01, post02, ipplan,
    sweb3a, sweb1d, sweb1a, mx02, mysql02b, sweb2b, mysql02a, stor2a, sweb2a, opsview, bak2, vs1o, vs2o, ipa2, vs1, vs2, vs3, vs4, vs5, vs6, vsd1, vsd2, vsd3, vsd4, vsd5, vsd6, vsd7, vsd8, nsb, nsa, mail1, mail2, lb02, lb01, iscsi01, iscsi02, hlvs1.studio100.
    ch


    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3057-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso
    April 07, 2015 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : libxml2
    Debian Bug : 774358

    The update for libxml2 issued as DSA-3057-1 caused regressions due to an incomplete patch to address CVE-2014-3660. Updated packages are available to address this problem. For reference the original advisory text follows.

    Sogeti found a denial of service flaw in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to
    excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.
    (CVE-2014-3660)

    For the stable distribution (wheezy), this problem has been fixed in version 2.8.0+dfsg1-7+wheezy4.

    We recommend that you upgrade your libxml2 packages.

    Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

    Mailing list: [email protected]


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: https://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)