Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 536
Alerts This Week
Warning Icon 1 536

Ubuntu 14.04 LTS USN-2389-1 Moderate: libxml2 DoS Threat

ubuntu
Calendar Grey October 27, 2014
Scroller Ubuntu
Ensure that your Ubuntu LTS installations are patched to address the libxml2 vulnerability that is resulting in excessive resource usage and potentially leading to denial-of-service scenarios.
libxml2 could be made to consume resources if it processed a specially crafted file.

Summary

libxml2 could be made to consume resources if it processed a specially

crafted file.

Software Description:

- libxml2: GNOME XML library

Details:

It was discovered that libxml2 would incorrectly perform entity

substitution even when requested not to. If a user or automated system were

tricked into opening a specially crafted document, an attacker could

possibly cause resource consumption, resulting in a denial of service.

Topics%20covered

Topics Covered

security advisory denial of service ubuntu libxml2 resource consumption

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libxml2                         2.9.1+dfsg1-3ubuntu4.4

Ubuntu 12.04 LTS:
  libxml2                         2.7.8.dfsg-5.1ubuntu4.11

Ubuntu 10.04 LTS:
  libxml2                         2.7.6.dfsg-1ubuntu1.15

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2389-1

CVE-2014-3660

Severity
important
Lowest
Low
Medium
High
Critical

October 27, 2014

Topics%20covered

Topics Covered

security advisory denial of service ubuntu libxml2 resource consumption

Package Information

https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.4
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.11
https://launchpad.net/ubuntu/+source/libxml2/2.7.6.dfsg-1ubuntu1.15

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.