- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201412-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: libxml2: Denial of Service
     Date: December 10, 2014
     Bugs: #525656
       ID: 201412-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
A vulnerability in libxml2 could result in Denial of Service.

Background
=========
libxml2 is the XML C parser and toolkit developed for the Gnome
project.

Affected packages
================
    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  dev-libs/libxml2             < 2.9.2                    >= 2.9.2

Description
==========
parser.c in libxml2 before 2.9.2 does not properly prevent entity
expansion even when entity substitution has been disabled.

Impact
=====
A context-dependent attacker could entice a user to a specially crafted
XML file using an application linked against libxml2, possibly
resulting in a Denial of Service condition.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All libxml2 users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.2"

Packages which depend on this library may need to be recompiled. Tools
such as revdep-rebuild may assist in identifying these packages.

References
=========
[ 1 ] CVE-2014-3660
      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3660

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/glsa-201412-06.xml

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo: GLSA-201412-06: libxml2: Denial of Service

A vulnerability in libxml2 could result in Denial of Service.

Summary

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled.

Resolution

All libxml2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.2"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.

References

[ 1 ] CVE-2014-3660 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3660

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/glsa-201412-06.xml

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Normal
Title: libxml2: Denial of Service
Date: December 10, 2014
Bugs: #525656
ID: 201412-06

Synopsis

A vulnerability in libxml2 could result in Denial of Service.

Background

libxml2 is the XML C parser and toolkit developed for the Gnome project.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/libxml2 < 2.9.2 >= 2.9.2

Impact

===== A context-dependent attacker could entice a user to a specially crafted XML file using an application linked against libxml2, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.