Debian: New libxml2 packages fix several vulnerabilities

    Date17 Nov 2008
    CategoryDebian
    3884
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities have been discovered in the GNOME XML library. The Common Vulnerabilities and Exposures project identifies the following problems: Drew Yao discovered that missing input sanitising in the xmlBufferResize() function may lead to an infinite loop, resulting in denial of service.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1666-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                       Moritz Muehlenhoff
    November 17, 2008                     http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : libxml2
    Vulnerability  : several
    Problem type   : local(remote)
    Debian-specific: no
    CVE Id(s)      : CVE-2008-4225 CVE-2008-4226
    
    Several vulnerabilities have been discovered in the GNOME XML library.
    The Common Vulnerabilities and Exposures project identifies the 
    following problems:
    
    CVE-2008-4225
    
        Drew Yao discovered that missing input sanitising in the
        xmlBufferResize() function may lead to an infinite loop,
        resulting in denial of service.
    
    CVE-2008-4226
    
        Drew Yao discovered that an integer overflow in the
        xmlSAX2Characters() function may lead to denial of service or
        the execution of arbitrary code.
    
    For the stable distribution (etch), these problems have been fixed in
    version 2.6.27.dfsg-6.
    
    For the upcoming stable distribution (lenny) and the unstable
    distribution (sid), these problems will be fixed soon.
    
    We recommend that you upgrade your libxml2 packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc
        Size/MD5 checksum:      893 b6b2006ffadfb999e72974d574814b7c
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz
        Size/MD5 checksum:  3416175 5ff71b22f6253a6dd9afc1c34778dec3
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz
        Size/MD5 checksum:   147867 d6a3bbbe39bffe96867de82b11c7c5be
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb
        Size/MD5 checksum:  1328280 c2990030601040775b909c8ace076100
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb
        Size/MD5 checksum:   881946 38629543e71a18f6007b8d61d0500e36
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb
        Size/MD5 checksum:   821150 f14ee677bb7eac20cd65adef90af0f3c
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb
        Size/MD5 checksum:    37972 d7757b07f8b0c69f9fd0a07a1598a3e3
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb
        Size/MD5 checksum:   184750 020e5ca7663ee88695e1502c8e8af77c
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb
        Size/MD5 checksum:   917020 f837c687d428d94559bf68e012bc0e02
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb
        Size/MD5 checksum:   745790 94edf60cc7d02dd31a70376baf740958
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb
        Size/MD5 checksum:   892010 a648a6d69a73593739035d78ed3c8436
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb
        Size/MD5 checksum:   796410 9f38a5028c33f32cf1701535c1c37984
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb
        Size/MD5 checksum:    36682 4de1bfa28b9361e462075451befbe66c
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb
        Size/MD5 checksum:   184126 1aae3163d718d0c378203b7ea1a53a9b
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb
        Size/MD5 checksum:   673236 cda6995615db6e74610d8a51607e85e4
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb
        Size/MD5 checksum:   817602 c5f81e370d055ba14a40a64d3fbb6e9e
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb
        Size/MD5 checksum:    34682 4b01403ce80c2949f31559e0eacc044b
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb
        Size/MD5 checksum:   165284 f84251cc53fa6b67b7fb55f58dd47d5b
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb
        Size/MD5 checksum:   742176 2e9e6cbbc777d49a99d8a6d98c5dc799
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb
        Size/MD5 checksum:   858220 0f8cf389ab60a7639fac0f6499325995
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb
        Size/MD5 checksum:   863998 2332655d5ec188cf038cf9fcab862d9f
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb
        Size/MD5 checksum:   850370 6c600a26f96c3a3eea898821b0a63937
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb
        Size/MD5 checksum:    36852 75d6a8790e01eacb3183e6f295542215
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb
        Size/MD5 checksum:   192850 f635c62c33d9a2ea17015b08370dfd8f
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb
        Size/MD5 checksum:   857246 6cebb1b5f8e5e87c00319eb59df9c497
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb
        Size/MD5 checksum:   169026 31acf12efa0a8f37045f3f0869b894f8
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb
        Size/MD5 checksum:   681544 f0f383f2ea6ae309bfbcd13f2a2e8efa
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb
        Size/MD5 checksum:   756128 f776e4a0c28389602bb6b26965fc70ce
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb
        Size/MD5 checksum:    34496 0cf1427860bb36162af23351285ff091
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb
        Size/MD5 checksum:   196528 3eaa55301a20961852f3a3c5b64bde8c
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb
        Size/MD5 checksum:    48494 280c616ff34b4aa41a48173828b6e66c
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb
        Size/MD5 checksum:  1106616 e7b32b8f711337ca52a041af581a05b6
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb
        Size/MD5 checksum:  1080448 a7334ed64dba73272b2001e09d18493f
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb
        Size/MD5 checksum:   874194 1410e29414572197b6f82dd5a8be061f
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb
        Size/MD5 checksum:   840690 ad2ce083ff5c14656ea3ae28b0fa783d
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb
        Size/MD5 checksum:   770540 d1faeaa723c3de301fb4c8a44ece376a
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb
        Size/MD5 checksum:    34424 c7c9469462957365ab26e7f06e1f0521
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb
        Size/MD5 checksum:   171674 5e6f7cbe84d053bd19dda54346330f75
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb
        Size/MD5 checksum:   926930 c4a3402711ebb05f38b1146eebcd0a71
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb
        Size/MD5 checksum:    34396 79f5ff849d9a0ed01ab567ec542b7f3e
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb
        Size/MD5 checksum:   898480 c195cceafe5efce1de168475a462be54
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb
        Size/MD5 checksum:   769244 d0d36bff7e63adf76857166c3ed10daa
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb
        Size/MD5 checksum:   168696 3667deae6585a788c4da731b4fc9383d
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb
        Size/MD5 checksum:   833258 4b1612f79d4b9d1ce2d7086fbb8edbd0
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb
        Size/MD5 checksum:   780124 0d2ed3ecc5a1e7a5ce3870fab1bcfc43
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb
        Size/MD5 checksum:   172736 2011f174234c5e939cebeedc2fd9e707
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb
        Size/MD5 checksum:    37662 94991d67033b1b921bb72e5d7bf2b844
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb
        Size/MD5 checksum:   898080 321d90790cf68bc046b9b577e7986438
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb
        Size/MD5 checksum:   771124 47b6d53839ea42f54ae6ad2b89594a26
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb
        Size/MD5 checksum:    36368 fbc5505f4471c4c2fe6ad41903c5596f
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb
        Size/MD5 checksum:   885484 ead63bcf342e568c9c338c2772ea4e0d
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb
        Size/MD5 checksum:   750248 ed7465c981212e90fac94dc040ac6bb4
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb
        Size/MD5 checksum:   185718 414512cb0af24a7c5e3622b75ef9b56f
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb
        Size/MD5 checksum:   806342 0f85b6120fdba835eaf39d02b4a606d9
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb
        Size/MD5 checksum:    34578 dd02c5498d378ee75330f8f93b2eb3a7
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb
        Size/MD5 checksum:   781490 ecf288ea66fc19e8f9874b90884a888e
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb
        Size/MD5 checksum:   713214 434a8a91f3a4acbfc3df2a2707acbbe0
      http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb
        Size/MD5 checksum:   759786 83ba89269fd32296c48c8498e100372b
      http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb
        Size/MD5 checksum:   176878 9840698d19580fe86bfc55a2347361e5
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.