Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

SUSE: 2020:2173-1 Moderate: Perl-XML-Twig Security Issue

suse
Calendar Grey August 7, 2020
Dist Suse Esm H88
The latest patch addresses a vulnerability within perl-XML-Twig on SUSE systems, mitigating risks associated with harmful XML manipulation.
An update that fixes one vulnerability is now available

Summary

This update for perl-XML-Twig fixes the following issues: - Security fix [bsc#1008644, CVE-2016-9180] * Added: the no_xxe option to XML::Twig::new, which causes the parse to fail if external entities are used (to prevent malicious XML to access the filesystem). * Setting expand_external_ents to 0 or -1 currently doesn't work as expected; To completely turn off expanding external entities use no_xxe. * Update documentation for XML::Twig to mention problems with expand_external_ents and add information about new no_xxe argument Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP5:

Topics%20covered

Topics Covered

security advisory moderate security issue update SUSE perl-XML-Twig malicious XML

References

#1008644

Cross- CVE-2016-9180

Affected Products:

SUSE Linux Enterprise Server 12-SP5

https://www.suse.com/security/cve/CVE-2016-9180.html

https://bugzilla.suse.com/1008644

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:2173-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate security issue update SUSE perl-XML-Twig malicious XML

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here