Ubuntu 16.04 LTS: USN-2634-1 Security: libxml2 Denial Of Service

ubuntu

October 4, 2012

Applications using libxslt could be made to crash or run programs as your login if they processed a specially crafted file.

Summary

Applications using libxslt could be made to crash or run programs as your

Software Description:

- libxslt: XSLT processing library

Details:

Chris Evans discovered that libxslt incorrectly handled generate-id XPath

functions. If a user or automated system were tricked into processing a

specially crafted XSLT document, a remote attacker could obtain potentially

sensitive information. This issue only affected Ubuntu 8.04 LTS, Ubuntu

10.04 LTS and Ubuntu 11.04. (CVE-2011-1202)

It was discovered that libxslt incorrectly parsed certain patterns. If a

user or automated system were tricked into processing a specially crafted

XSLT document, a remote attacker could cause libxslt to crash, causing a

denial of service. (CVE-2011-3970)

Nicholas Gregoire discovered that libxslt incorrectly handled unexpected

DTD nodes. If a user or automated system were tricked into processing a

specially crafted XSLT document, a remote...

Read the Full Advisory

Topics Covered

security advisory denial of service software update Ubuntu library vulnerability

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libxslt1.1                      1.1.26-8ubuntu1.2

Ubuntu 11.10:
  libxslt1.1                      1.1.26-7ubuntu0.1

Ubuntu 11.04:
  libxslt1.1                      1.1.26-6ubuntu0.1

Ubuntu 10.04 LTS:
  libxslt1.1                      1.1.26-1ubuntu1.1

Ubuntu 8.04 LTS:
  libxslt1.1                      1.1.22-1ubuntu1.3

In general, a standard system update will make all the necessary changes.