Stay Secure with the Latest Linux Advisories

security advisorysecurity issuecritical

Debian 9 DLA-2669-1: Critical LibXML2 Parameter Laughs Attack

An issue has been found in libxml2, the GNOME XML library. This issue is called "Parameter Laughs"-attack and is related to parameter entities expansion. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2669-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Thorsten Alteholz May 30, 2021 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : libxml2 Version : 2.9.4+dfsg1-2.2+deb9u5 CVE ID : CVE-2021-3541 An issue has been found in libxml2, the GNOME XML library. This issue is called "Parameter Laughs"-attack and is related to parameter entities expansion. It is similar to the "Billion Laughs"-attacks found earlier in libexpat. More information can be found at [1] [1] https://blog.hartwork.org/posts/cve-2021-3541-parameter-laughs-fixed-in-libxml2-2-9-11/ For Debian 9 stretch, this problem has been fixed in version 2.9.4+dfsg1-2.2+deb9u5. We recommend that you upgrade your libxml2 packages. For the detailed security status of libxml2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/libxml2 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS DLA-2670-1 mitigates a severe Domain Spoofing vulnerability in openssl, please update your environment promptly.. debian lts, libxml2, parameter laughs attack, security update. . Severity: Critical. LinuxSecurity.com Team

May 30, 2021 •Critical Debian LTS