Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
219
security advisorymoderateupdateRocky Linux 9 RLSA-2023:0338 Moderate: Libxml2 Integer Overflow
Moderate: libxml2 security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2023:0338", "synopsis": "Moderate: libxml2 security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for libxml2.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "The libxml2 library is a development toolbox providing the implementation of various XML standards.\n\nSecurity Fix(es):\n\n* libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)\n\n* libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2136266", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2136266", "description": ""}, {"ticket": "2136288", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2136288", "description": ""}], "cves": [{"name": "CVE-2022-40303", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2022-40303", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvss3BaseScore": "8.2", "cwe": "CWE-190"}, {"name": "CVE-2022-40304", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2022-40304", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvss3BaseScore": "8.2", "cwe": "CWE-415"}], "references": [], "publishedAt": "2023-01-23T14:30:36Z", "rpms": {"Rocky Linux 9": {"nvras": ["libxml2-0:2.9.13-3.el9_1.aarch64.rpm", "libxml2-0:2.9.13-3.el9_1.i686.rpm", "libxml2-0:2.9.13-3.el9_1.ppc64le.rpm", "libxml2-0:2.9.13-3.el9_1.s390x.rpm", "libxml2-0:2.9.13-3.el9_1.src.rpm", "libxml2-0:2.9.13-3.el9_1.x86_64.rpm","libxml2-debuginfo-0:2.9.13-3.el9_1.aarch64.rpm", "libxml2-debuginfo-0:2.9.13-3.el9_1.ppc64le.rpm", "libxml2-debuginfo-0:2.9.13-3.el9_1.s390x.rpm", "libxml2-debuginfo-0:2.9.13-3.el9_1.x86_64.rpm", "libxml2-debugsource-0:2.9.13-3.el9_1.aarch64.rpm", "libxml2-debugsource-0:2.9.13-3.el9_1.ppc64le.rpm", "libxml2-debugsource-0:2.9.13-3.el9_1.s390x.rpm", "libxml2-debugsource-0:2.9.13-3.el9_1.x86_64.rpm", "libxml2-devel-0:2.9.13-3.el9_1.aarch64.rpm", "libxml2-devel-0:2.9.13-3.el9_1.i686.rpm", "libxml2-devel-0:2.9.13-3.el9_1.ppc64le.rpm", "libxml2-devel-0:2.9.13-3.el9_1.s390x.rpm", "libxml2-devel-0:2.9.13-3.el9_1.x86_64.rpm", "python3-libxml2-0:2.9.13-3.el9_1.aarch64.rpm", "python3-libxml2-0:2.9.13-3.el9_1.ppc64le.rpm", "python3-libxml2-0:2.9.13-3.el9_1.s390x.rpm", "python3-libxml2-0:2.9.13-3.el9_1.x86_64.rpm", "python3-libxml2-debuginfo-0:2.9.13-3.el9_1.aarch64.rpm", "python3-libxml2-debuginfo-0:2.9.13-3.el9_1.ppc64le.rpm", "python3-libxml2-debuginfo-0:2.9.13-3.el9_1.s390x.rpm", "python3-libxml2-debuginfo-0:2.9.13-3.el9_1.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Rocky Linux has issued a vital security update for libxml2, mitigating serious vulnerabilities that threaten system integrity and security. libxml2, Rocky Linux, security update, integer overflow, reference cycle. . LinuxSecurity.com Team
Jan 23, 2023
Rocky Linux
98
security advisorymoderatesecurity updateRed Hat Enterprise Linux 8 Advisory RHSA-2023:0173-01 Libxml2 Update Moderate
An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: libxml2 security update Advisory ID: RHSA-2023:0173-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:0173 Issue date: 2023-01-16 CVE Names: CVE-2022-40303 CVE-2022-40304 ==================================================================== 1. Summary: An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303) * libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The desktop must be restarted (log out, then log backin) for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2136266 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE 2136288 - CVE-2022-40304 libxml2: dict corruption caused by entity reference cycles 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: libxml2-debuginfo-2.9.7-15.el8_7.1.aarch64.rpm libxml2-debugsource-2.9.7-15.el8_7.1.aarch64.rpm libxml2-devel-2.9.7-15.el8_7.1.aarch64.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.aarch64.rpm ppc64le: libxml2-debuginfo-2.9.7-15.el8_7.1.ppc64le.rpm libxml2-debugsource-2.9.7-15.el8_7.1.ppc64le.rpm libxml2-devel-2.9.7-15.el8_7.1.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.ppc64le.rpm s390x: libxml2-debuginfo-2.9.7-15.el8_7.1.s390x.rpm libxml2-debugsource-2.9.7-15.el8_7.1.s390x.rpm libxml2-devel-2.9.7-15.el8_7.1.s390x.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.s390x.rpm x86_64: libxml2-debuginfo-2.9.7-15.el8_7.1.i686.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.x86_64.rpm libxml2-debugsource-2.9.7-15.el8_7.1.i686.rpm libxml2-debugsource-2.9.7-15.el8_7.1.x86_64.rpm libxml2-devel-2.9.7-15.el8_7.1.i686.rpm libxml2-devel-2.9.7-15.el8_7.1.x86_64.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.i686.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.x86_64.rpm Red Hat Enterprise Linux BaseOS (v.8): Source: libxml2-2.9.7-15.el8_7.1.src.rpm aarch64: libxml2-2.9.7-15.el8_7.1.aarch64.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.aarch64.rpm libxml2-debugsource-2.9.7-15.el8_7.1.aarch64.rpm python3-libxml2-2.9.7-15.el8_7.1.aarch64.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.aarch64.rpm ppc64le: libxml2-2.9.7-15.el8_7.1.ppc64le.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.ppc64le.rpm libxml2-debugsource-2.9.7-15.el8_7.1.ppc64le.rpm python3-libxml2-2.9.7-15.el8_7.1.ppc64le.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.ppc64le.rpm s390x: libxml2-2.9.7-15.el8_7.1.s390x.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.s390x.rpm libxml2-debugsource-2.9.7-15.el8_7.1.s390x.rpm python3-libxml2-2.9.7-15.el8_7.1.s390x.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.s390x.rpm x86_64: libxml2-2.9.7-15.el8_7.1.i686.rpm libxml2-2.9.7-15.el8_7.1.x86_64.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.i686.rpm libxml2-debuginfo-2.9.7-15.el8_7.1.x86_64.rpm libxml2-debugsource-2.9.7-15.el8_7.1.i686.rpm libxml2-debugsource-2.9.7-15.el8_7.1.x86_64.rpm python3-libxml2-2.9.7-15.el8_7.1.x86_64.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.i686.rpm python3-libxml2-debuginfo-2.9.7-15.el8_7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-40303 https://access.redhat.com/security/cve/CVE-2022-40304 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBY8UoQ9zjgjWX9erEAQgOHQ/+Ns7MY8MsoyU3wlWkuTW5mCenVYaSQa90 nHACMcvLgOKjM61s7FTXHnvV52TKj/+kZRToW2MCOTfuLsYnP0bZ+DFLkhDxoIGR wN6X2Mgh/vtBmdLGtW8bjclpJuYLoGrjfoigFOZgXbRrKBNYLZqLPNutHzcF1IB2 hxdTDn7W+RNjCiP8+l+cTGYx0A9e1rYkCEx5B8qKfJY11/ojBTvxMf2jVnkFM9gz ZwVCDtUyO7S7B5l6OqvH9qcR8dBOMw5KpaE4wGc+RF9iYI3t68xJlB2bj21Eb1oW I4OwkkOh9i96f2XtusnTZIdJWVEMHJ3ZjM8a40nB7OzV0zSRRml61CLvLur6YAdo nxQ3bstsq2+NhK/J0pHLUaVLQxeePgvHICJBIBXRV/bFHZw3qADo08FmvcVh4y9t HSyYP6ZdofwxeR6elSke2cM57RWIcDVB8+o6ESUN4q5QMp6xjmA+82tHLmbguwyb RMTW46jCZ3tZOo5+zIXBGlwvMZGv5PDzzgjwEboxBoWTGegBdPJkNNmezj9pZcyB 0l2Uh2LtC/uPbqBFzsPy94pyEd4VoRAY5/RBS+PgLCJm4o2qsaTN75jqHpSQXgw8 CfZT3+0XnYvsYHBt8jtiVUpHJpbfh9vNNjXzcLO/JKCv8NW3So1MfV2A+mT/mDmh nCQ8kAI62fw=pLiQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Jan 16, 2023
Red Hat
89
security advisoryfedoraupdateFedora 37: Critical libxml2 Integer Overflow and Dict Corruption Issues
Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-a6812b0224 2022-11-13 01:11:59.258299 --------------------------------------------------------------------------------Name : libxml2 Product : Fedora 37 Version : 2.10.3 Release : 2.fc37 URL : Summary : Library providing XML and HTML support Description : This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. --------------------------------------------------------------------------------Update Information: Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304 --------------------------------------------------------------------------------ChangeLog: * Thu Nov 3 2022 Adam Williamson - 2.10.3-2 - Set build options to maintain (most) symbols from 2.9.14 (#2139546) * Thu Oct 20 2022 David King - 2.10.3-1 - Update to 2.10.3 (#2119077) * Tue Aug 30 2022 David King - 2.10.2-1 - Update to 2.10.2 (#2119077) --------------------------------------------------------------------------------References: [ 1 ] Bug #2119077 - libxml2-2.10.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2119077 [ 2 ] Bug #2136274 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2136274 [ 3 ] Bug #2136293 - CVE-2022-40304 libxml2: dict corruption caused by entity reference cycles[fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2136293 [ 4 ] Bug #2136800 - openconnect fails due to missing symbol xmlIOFTPRead https://bugzilla.redhat.com/show_bug.cgi?id=2136800 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-a6812b0224' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 12, 2022
•Critical
Fedora
203
security advisoryinteger overflowlibxml2Mageia 8: MGASA-2022-0412 Moderate: Libxml2 Integer Overflow Threat
Integer overflows with XML_PARSE_HUGE. (CVE-2022-40303) Dict corruption caused by entity reference cycles. (CVE-2022-40304) References: - https://bugs.mageia.org/show_bug.cgi?id=31020 . MGASA-2022-0412 - Updated libxml2 packages fix security vulnerability Publication date: 08 Nov 2022 URL: https://advisories.mageia.org/MGASA-2022-0412.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-40303, CVE-2022-40304 Integer overflows with XML_PARSE_HUGE. (CVE-2022-40303) Dict corruption caused by entity reference cycles. (CVE-2022-40304) References: - https://bugs.mageia.org/show_bug.cgi?id=31020 - - https://lists.fedoraproject.org/archives/list/
Nov 08, 2022
Mageia
89
security advisoryfedoraupdateFedora 36: Critical Libxml2 Integer Overflow and Dict Corruption Issue
Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-aeafd24818 2022-10-25 13:12:34.597448 --------------------------------------------------------------------------------Name : libxml2 Product : Fedora 36 Version : 2.10.3 Release : 1.fc36 URL : https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home Summary : Library providing XML and HTML support Description : This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library. --------------------------------------------------------------------------------Update Information: Update to 2.10.3 * Fix CVE-2022-40303 * Fix CVE-2022-40304 --------------------------------------------------------------------------------ChangeLog: * Thu Oct 20 2022 David King - 2.10.3-1 - Update to 2.10.3 (#2119077) * Tue Aug 30 2022 David King - 2.10.2-1 - Update to 2.10.2 (#2119077) --------------------------------------------------------------------------------References: [ 1 ] Bug #2119077 - libxml2-2.10.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2119077 [ 2 ] Bug #2136274 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2136274 [ 3 ] Bug #2136293 - CVE-2022-40304 libxml2: dict corruption caused by entity reference cycles [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2136293 [ 4 ] Bug #2136800 - openconnect fails due to missing symbol xmlIOFTPRead https://bugzilla.redhat.com/show_bug.cgi?id=2136800 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-aeafd24818' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 25, 2022
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!