Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 17.10: USN-3504-1 Critical: Libxml2 Denial of Service

ubuntu
Calendar Grey December 5, 2017
Scroller Ubuntu
Upgrade your Ubuntu installations to address a significant libxml2 vulnerability and protect against potential denial-of-service exploits.
libxml2 could be made to crash if it opened a specially craftedfile.

Summary

libxml2 could be made to crash if it opened a specially crafted

file.

Software Description:

- libxml2: GNOME XML library

Details:

Wei Lei discovered that libxml2 incorrecty handled certain parameter

entities. An attacker could use this issue with specially constructed

XML data to cause libxml2 to consume resources, leading to a denial of

service.

Topics%20covered

Topics Covered

security advisory denial of service software update ubuntu libxml2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
  libxml2                         2.9.4+dfsg1-4ubuntu1.1
  libxml2-utils                   2.9.4+dfsg1-4ubuntu1.1
  python-libxml2                  2.9.4+dfsg1-4ubuntu1.1
  python3-libxml2                 2.9.4+dfsg1-4ubuntu1.1

Ubuntu 17.04:
  libxml2                         2.9.4+dfsg1-2.2ubuntu0.2
  libxml2-utils                   2.9.4+dfsg1-2.2ubuntu0.2
  python-libxml2                  2.9.4+dfsg1-2.2ubuntu0.2
  python3-libxml2                 2.9.4+dfsg1-2.2ubuntu0.2

Ubuntu 16.04 LTS:
  libxml2                         2.9.3+dfsg1-1ubuntu0.4
  libxml2-utils                   2.9.3+dfsg1-1ubuntu0.4
  python-libxml2                  2.9.3+dfsg1-1ubuntu0.4

Ubuntu 14.04 LTS:
  libxml2                         2.9.1+dfsg1-3ubuntu4.11
  libxml2-utils                   2.9.1+dfsg1-3ubuntu4.11
  python-libxml2                  2.9.1+dfsg1-3ubuntu4.11

In general, a standard system update will make all the necessary
changes.

References

  https://ubuntu.com/security/notices/USN-3504-1

  CVE-2017-16932

Severity
critical
Lowest
Low
Medium
High
Critical

December 05, 2017

Topics%20covered

Topics Covered

security advisory denial of service software update ubuntu libxml2

Package Information

  https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-4ubuntu1.1
  https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-2.2ubuntu0.2
  https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.4
  https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.11

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.