Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Critical Risk in libxslt Vulnerability Exploit: Red Hat EL RHSA-2008-0287

red hat
Calendar Grey May 21, 2008
Dist Redhat Esm H88
An important libxslt revision has been launched; severe vulnerabilities highlighted by Red Hat. Users are advised to update without delay.
Updated libxslt packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team.

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

libxslt is a C library, based on libxml, for parsing of XML files into other textual formats (eg HTML, plain text and other XML representations of the underlying data). It uses the standard XSLT stylesheet transformation mechanism and, being written in plain ANSI C, is designed to be simple to incorporate into other applications
Anthony de Almeida Lopes reported the libxslt library did not properly process long "transformation match" conditions in the XSL stylesheet files. An attacker could create a malicious XSL file that would cause a crash, or, possibly, execute and arbitrary code with the privileges of the application using libxslt library to perform XSL transformations. (CVE-2008-1767)
All users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

Topics%20covered

Topics Covered

security advisory Red Hat software update Red Hat Enterprise Linux important code execution risk libxslt

References

https://www.cve.org/CVERecord?id=CVE-2008-1767 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :
Source:
i386: libxslt-1.0.15-3.i386.rpm libxslt-devel-1.0.15-3.i386.rpm libxslt-python-1.0.15-3.i386.rpm
ia64: libxslt-1.0.15-3.ia64.rpm libxslt-devel-1.0.15-3.ia64.rpm libxslt-python-1.0.15-3.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
Source:
ia64: libxslt-1.0.15-3.ia64.rpm libxslt-devel-1.0.15-3.ia64.rpm libxslt-python-1.0.15-3.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
Source:
i386: libxslt-1.0.15-3.i386.rpm libxslt-devel-1.0.15-3.i386.rpm libxslt-python-1.0.15-3.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
Source:
i386: libxslt-1.0.15-3.i386.rpm libxslt-devel-1.0.15-3.i386.rpm libxslt-python-1.0.15-3.i386.rpm
Red Hat Enterprise Linux AS version 3:
Source:
i386: libxslt-1.0.33-6.i386.rpm libxslt-debuginfo-1.0.33-6.i386.rpm libxslt-devel-1.0.33-6.i386.rpm
ia64: libxslt-1.0.33-6.i386.rpm libxslt-1.0.33-6.ia64.rpm libxslt-debuginfo-1.0.33-6.i386.rpm libxslt-debuginfo-1.0.33-6.ia64.rpm libxslt-devel-1.0.33-6.ia64.rpm
ppc: libxslt-1.0.33-6.ppc.rpm libxslt-1.0.33-6.ppc64.rpm libxslt-debuginfo-1.0.33-6.ppc.rpm libxslt-debuginfo-1.0.33-6.ppc64.rpm libxslt-devel-1.0.33-6.ppc.rpm
s390: libxslt-1.0.33-6.s390.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2008:0287-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2008:0287.html
Issue date: 2008-05-21

Topic

Updated libxslt packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Topics%20covered

Topics Covered

security advisory Red Hat software update Red Hat Enterprise Linux important code execution risk libxslt

Relevant Releases Architectures

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64

Red Hat Linux Advanced Workstation 2.1 - ia64

Red Hat Enterprise Linux ES version 2.1 - i386

Red Hat Enterprise Linux WS version 2.1 - i386

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Desktop version 3 - i386, x86_64

Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

446809 - CVE-2008-1767 libxslt: fixed-sized steps array overflow via "template match" condition in XSL file

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here