Ubuntu 17.04: USN-3271-1 Critical: Libxslt Denial Of Service Advisory

ubuntu

April 28, 2017

Several security issues were fixed in Libxslt.

Summary

Several security issues were fixed in Libxslt.

Software Description:

- libxslt: XSLT processing library

Details:

Holger Fuhrmannek discovered an integer overflow in the

xsltAddTextString() function in Libxslt. An attacker could use

this to craft a malicious document that, when opened, could cause a

denial of service (application crash) or possible execute arbitrary

code. (CVE-2017-5029)

Nicolas Gregoire discovered that Libxslt mishandled namespace

nodes. An attacker could use this to craft a malicious document that,

when opened, could cause a denial of service (application crash)

or possibly execute arbtrary code. This issue only affected Ubuntu

16.04 LTS, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. (CVE-2016-1683)

Sebastian Apelt discovered that a use-after-error existed in the

xsltDocumentFunctionLoadDocument() function in Libxslt. An attacker

could use this to craft a malicious document that, when opened,

could cause a denial of service (application crash) or possibly

execute a...

Read the Full Advisory

Topics Covered

security advisory denial of service critical ubuntu libxslt

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  libxslt1.1                      1.1.29-2ubuntu0.1

Ubuntu 16.10:
  libxslt1.1                      1.1.29-1ubuntu0.1

Ubuntu 16.04 LTS:
  libxslt1.1                      1.1.28-2.1ubuntu0.1

Ubuntu 14.04 LTS:
  libxslt1.1                      1.1.28-2ubuntu0.1

Ubuntu 12.04 LTS:
  libxslt1.1                      1.1.26-8ubuntu1.4

In general, a standard system update will make all the necessary changes.