Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.1575
SUSE Security Update: Security update for libxml2
5 November 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libxml2
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2013-2877 CVE-2013-0339 CVE-2013-0338
CVE-2012-5134 CVE-2012-2807 CVE-2012-0841
CVE-2011-3919 CVE-2011-3102
Reference: ASB-2013.0083
ASB-2013.0057
ASB-2012.0164
ASB-2012.0096
ESB-2012.0217
ESB-2012.0202
ESB-2012.0201
ESB-2012.0145
ESB-2012.0088
ESB-2012.0053
Original Bulletin:
http://support.novell.com/security/cve/CVE-2011-3102.html
http://support.novell.com/security/cve/CVE-2011-3919.html
http://support.novell.com/security/cve/CVE-2012-0841.html
http://support.novell.com/security/cve/CVE-2012-2807.html
http://support.novell.com/security/cve/CVE-2012-5134.html
http://support.novell.com/security/cve/CVE-2013-0338.html
http://support.novell.com/security/cve/CVE-2013-0339.html
http://support.novell.com/security/cve/CVE-2013-2877.html
Comment: This bulletin contains two (2) Novell security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for libxml2
______________________________________________________________________________
Announcement ID: SUSE-SU-2013:1625-1
Rating: important
References: #739894 #748561 #764538 #769184 #793334 #805233
#829077
Cross-References: CVE-2011-3102 CVE-2011-3919 CVE-2012-0841
CVE-2012-2807 CVE-2012-5134 CVE-2013-0338
CVE-2013-0339 CVE-2013-2877
Affected Products:
SUSE Linux Enterprise Server 10 SP3 LTSS
______________________________________________________________________________
An update that fixes 8 vulnerabilities is now available.
Description:
This is a LTSS rollup update for the libxml2 library that
fixes various security issues.
CVE-2013-2877: parser.c in libxml2 allowed remote
attackers to cause a denial of service (out-of-bounds read)
via a document that ends abruptly, related to the lack of
certain checks for the XML_PARSER_EOF state.
CVE-2013-0338: libxml2 allowed context-dependent
attackers to cause a denial of service (CPU and memory
consumption) via an XML file containing an entity
declaration with long replacement text and many references
to this entity, aka "internal entity expansion" with linear
complexity.
CVE-2012-5134: Heap-based buffer underflow in the
xmlParseAttValueComplex function in parser.c in libxml2
allowed remote attackers to cause a denial of service or
possibly execute arbitrary code via crafted entities in an
XML document.
CVE-2012-2807: Multiple integer overflows in libxml2
on 64-bit Linux platforms allowed remote attackers to cause
a denial of service or possibly have unspecified other
impact via unknown vectors.
CVE-2011-3102: Off-by-one error in libxml2 allowed
remote attackers to cause a denial of service
(out-of-bounds write) or possibly have unspecified other
impact via unknown vectors.
CVE-2012-0841: libxml2 computed hash values without
restricting the ability to trigger hash collisions
predictably, which allows context-dependent attackers to
cause a denial of service (CPU consumption) via crafted XML
data.
CVE-2011-3919: A heap-based buffer overflow during
decoding of entity references with overly long names has
been fixed.
Security Issue references:
* CVE-2013-0338
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0338>
* CVE-2013-0339
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339>
* CVE-2012-5134
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5134>
* CVE-2012-2807
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2807>
* CVE-2011-3102
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3102>
* CVE-2012-0841
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0841>
* CVE-2011-3919
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919>
* CVE-2013-2877
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877>
Package List:
- SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64):
libxml2-2.6.23-15.39.1
libxml2-devel-2.6.23-15.39.1
libxml2-python-2.6.23-15.39.1
- SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64):
libxml2-32bit-2.6.23-15.39.1
libxml2-devel-32bit-2.6.23-15.39.1
References:
http://support.novell.com/security/cve/CVE-2011-3102.html
http://support.novell.com/security/cve/CVE-2011-3919.html
http://support.novell.com/security/cve/CVE-2012-0841.html
http://support.novell.com/security/cve/CVE-2012-2807.html
http://support.novell.com/security/cve/CVE-2012-5134.html
http://support.novell.com/security/cve/CVE-2013-0338.html
http://support.novell.com/security/cve/CVE-2013-0339.html
http://support.novell.com/security/cve/CVE-2013-2877.html
https://bugzilla.novell.com/739894
https://bugzilla.novell.com/748561
https://bugzilla.novell.com/764538
https://bugzilla.novell.com/769184
https://bugzilla.novell.com/793334
https://bugzilla.novell.com/805233
https://bugzilla.novell.com/829077
http://download.novell.com/patch/finder/?keywords=a3fdb1e2e30b1877238605841d41d573
- -------------------------------------------------------------------------------
SUSE Security Update: Security update for libxml2
______________________________________________________________________________
Announcement ID: SUSE-SU-2013:1627-1
Rating: important
References: #829077
Cross-References: CVE-2011-3102 CVE-2011-3919 CVE-2012-0841
CVE-2012-2807 CVE-2012-5134 CVE-2013-0338
CVE-2013-0339 CVE-2013-2877
Affected Products:
SUSE Linux Enterprise Server 10 SP4 LTSS
______________________________________________________________________________
An update that fixes 8 vulnerabilities is now available.
Description:
libxml2 has been updated to fix the following security
issue:
* CVE-2013-0338: libxml2 allowed context-dependent
attackers to cause a denial of service (CPU and memory
consumption) via an XML file containing an entity
declaration with long replacement text and many references
to this entity, aka "internal entity expansion" with linear
complexity.
Security Issue references:
* CVE-2013-0338
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0338>
* CVE-2013-0339
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339>
* CVE-2012-5134
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5134>
* CVE-2012-2807
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2807>
* CVE-2011-3102
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3102>
* CVE-2012-0841
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0841>
* CVE-2011-3919
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919>
* CVE-2013-2877
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2877>
Package List:
- SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64):
libxml2-2.6.23-15.39.1
libxml2-devel-2.6.23-15.39.1
libxml2-python-2.6.23-15.39.1
- SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64):
libxml2-32bit-2.6.23-15.39.1
libxml2-devel-32bit-2.6.23-15.39.1
References:
http://support.novell.com/security/cve/CVE-2011-3102.html
http://support.novell.com/security/cve/CVE-2011-3919.html
http://support.novell.com/security/cve/CVE-2012-0841.html
http://support.novell.com/security/cve/CVE-2012-2807.html
http://support.novell.com/security/cve/CVE-2012-5134.html
http://support.novell.com/security/cve/CVE-2013-0338.html
http://support.novell.com/security/cve/CVE-2013-0339.html
http://support.novell.com/security/cve/CVE-2013-2877.html
https://bugzilla.novell.com/829077
http://download.novell.com/patch/finder/?keywords=aeb05c467f847178dc94b70e3bc77cc8
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUnhoFBLndAQH1ShLAQIumg/+MMLryYqcevege/3twwcLZ0147oJYiOMr
3L5CE7kXka8YwaLsjV24xTpDxb6ZxYe/nCIXYmM5iPJzAVtxgYbSrhP5H+dBbIYt
f2PbtwbazNkPFch3V8GrzT0YWTnc5hsr1PdXsRgKG41byRjijFeAeSJ5Pbh+JW2v
l1GCqpuL+NfWIbJEdelXZdevqGIv16+E7w1rRnqgqvxON0n1uOrZKcUdZUxrkTXu
cE2pgMkbHqTGsRGftCmyui0iJf45tBcc/5IDEhQxOoi8ASueNlFntpOqwNfGR+Ft
xhxszwQIyL1McjxFxPd+gvhXd7TcOILjOo6l+/ZKwtR2Gpxh/n+j/U7VOxxNcVDv
8FEy+CsaPwItaEhLKUXCKNia9RxDFogp1962EnSEYpXVFb/daxK0FWwLdY1Y4onf
xOzqXw4tt1Wqxi6BZ/fESzb5I8pgRpREJ7cMfjpz30kXCioGzt6H5a2u//rFWiB3
JmBzZjBozadGcCljbqYa5bwf+V64Oz47KoCFVPXghbgrQaEHlQZSN/yKSRFeemnH
+UFDnfQTeKHwEeew/bQ30AsP7l8W/VWBfpBPF/bsSenAvVYvrMSv6OEKf84OLQAQ
HGhaaow3ntHts+EabGjWjJ7b7FAEbEUERllQRoakt/bNJbS3WsCB2Z1RRNmM64k2
DXjHq5+DBxQ=
=7RIz
-----END PGP SIGNATURE-----