Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

SUSE 10 SP3 LTSS: 2013:1625-2 Critical: libxml2 Vulnerability Exploit

suse
Calendar Grey November 4, 2013
Scroller Suse
Red Hat Security Patch resolves 10 issues within openssl, implementing crucial updates and defenses.
An update that fixes 8 vulnerabilities is now available

Summary

This is a LTSS rollup update for the libxml2 library that fixes various security issues. * CVE-2013-2877: parser.c in libxml2 allowed remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state. * CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. * CVE-2012-5134: Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an

Topics%20covered

Topics Covered

security advisory denial of service security issue system integrity SUSE Linux important update libxml2

References

#739894 #748561 #764538 #769184 #793334 #805233

#829077

Cross- CVE-2011-3102 CVE-2011-3919 CVE-2012-0841

CVE-2012-2807 CVE-2012-5134 CVE-2013-0338

CVE-2013-0339 CVE-2013-2877

Affected Products:

SUSE Linux Enterprise Server 10 SP3 LTSS

https://www.suse.com/security/cve/CVE-2011-3102.html

https://www.suse.com/security/cve/CVE-2011-3919.html

https://www.suse.com/security/cve/CVE-2012-0841.html

https://www.suse.com/security/cve/CVE-2012-2807.html

https://www.suse.com/security/cve/CVE-2012-5134.html

https://www.suse.com/security/cve/CVE-2013-0338.html

https://www.suse.com/security/cve/CVE-2013-0339.html

https://www.suse.com/security/cve/CVE-2013-2877.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2013:1625-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service security issue system integrity SUSE Linux important update libxml2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.