Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Red Hat Enterprise Linux Moderate: RHSA-2008:0649-01 Buffer Overflow Risk

red hat
Calendar Grey July 31, 2008
Dist Redhat Esm H88
A recent libxslt enhancement for Red Hat remedies a critical buffer overflow issue. Apply this update to maintain your system's security.
Updated libxslt packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having moderate ...

Solution

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at

Summary

libxslt is a library for transforming XML files into other XML files using the standard XSLT stylesheet transformation mechanism.
A heap buffer overflow flaw was discovered in the RC4 libxslt library extension. An attacker could create a malicious XSL file that would cause a crash, or, possibly, execute arbitrary code with the privileges of the application using the libxslt library to perform XSL transformations on untrusted XSL style sheets. (CVE-2008-2935)
Red Hat would like to thank Chris Evans for reporting this vulnerability.
All libxslt users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

Topics%20covered

Topics Covered

security advisory moderate update buffer overflow Red Hat Enterprise Linux libxslt

References

https://www.cve.org/CVERecord?id=CVE-2008-2935 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat Enterprise Linux AS version 4:
Source:
i386: libxslt-1.1.11-1.el4_7.2.i386.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.i386.rpm libxslt-devel-1.1.11-1.el4_7.2.i386.rpm libxslt-python-1.1.11-1.el4_7.2.i386.rpm
ia64: libxslt-1.1.11-1.el4_7.2.i386.rpm libxslt-1.1.11-1.el4_7.2.ia64.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.i386.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.ia64.rpm libxslt-devel-1.1.11-1.el4_7.2.ia64.rpm libxslt-python-1.1.11-1.el4_7.2.ia64.rpm
ppc: libxslt-1.1.11-1.el4_7.2.ppc.rpm libxslt-1.1.11-1.el4_7.2.ppc64.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.ppc.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.ppc64.rpm libxslt-devel-1.1.11-1.el4_7.2.ppc.rpm libxslt-python-1.1.11-1.el4_7.2.ppc.rpm
s390: libxslt-1.1.11-1.el4_7.2.s390.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.s390.rpm libxslt-devel-1.1.11-1.el4_7.2.s390.rpm libxslt-python-1.1.11-1.el4_7.2.s390.rpm
s390x: libxslt-1.1.11-1.el4_7.2.s390.rpm libxslt-1.1.11-1.el4_7.2.s390x.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.s390.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.s390x.rpm libxslt-devel-1.1.11-1.el4_7.2.s390x.rpm libxslt-python-1.1.11-1.el4_7.2.s390x.rpm
x86_64: libxslt-1.1.11-1.el4_7.2.i386.rpm libxslt-1.1.11-1.el4_7.2.x86_64.rpm libxslt-debuginfo-1.1.11-1.el4_7.2.i386.rpm

Read the Full Advisory


Advisory ID: RHSA-2008:0649-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2008:0649.html
Issue date: 2008-07-31

Topic

Updated libxslt packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.


Topics%20covered

Topics Covered

security advisory moderate update buffer overflow Red Hat Enterprise Linux libxslt

Relevant Releases Architectures

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat Enterprise Linux Desktop version 4 - i386, x86_64

Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Bugs Fixed

455848 - CVE-2008-2935 libxslt: buffer overflow in libexslt RC4 encryption/decryption functions

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here