Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1145
libxml2 security update
1 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libxml2
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux Server 7
Impact/Access: Denial of Service -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-14567 CVE-2018-14404 CVE-2017-18258
CVE-2017-15412 CVE-2016-5131 CVE-2015-8035
Reference: ASB-2019.0169
ESB-2019.2162
ESB-2019.0955
ESB-2019.0384
ESB-2019.0130
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:1190
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libxml2 security update
Advisory ID: RHSA-2020:1190-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1190
Issue date: 2020-03-31
CVE Names: CVE-2015-8035 CVE-2016-5131 CVE-2017-15412
CVE-2017-18258 CVE-2018-14404 CVE-2018-14567
=====================================================================
1. Summary:
An update for libxml2 is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
The libxml2 library is a development toolbox providing the implementation
of various XML standards.
Security Fix(es):
* libxml2: Use after free triggered by XPointer paths beginning with
range-to (CVE-2016-5131)
* libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate()
function in xpath.c (CVE-2017-15412)
* libxml2: DoS caused by incorrect error detection during XZ decompression
(CVE-2015-8035)
* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in
xpath.c (CVE-2018-14404)
* libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
(CVE-2017-18258)
* libxml2: Infinite loop caused by incorrect error detection during LZMA
decompression (CVE-2018-14567)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The desktop must be restarted (log out, then log back in) for this update
to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1277146 - CVE-2015-8035 libxml2: DoS caused by incorrect error detection during XZ decompression
1358641 - CVE-2016-5131 libxml2: Use after free triggered by XPointer paths beginning with range-to
1523128 - CVE-2017-15412 libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c
1566749 - CVE-2017-18258 libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
1595985 - CVE-2018-14404 libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c
1619875 - CVE-2018-14567 libxml2: Infinite loop caused by incorrect error detection during LZMA decompression
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
ppc64:
libxml2-2.9.1-6.el7.4.ppc.rpm
libxml2-2.9.1-6.el7.4.ppc64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-devel-2.9.1-6.el7.4.ppc.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64.rpm
libxml2-python-2.9.1-6.el7.4.ppc64.rpm
ppc64le:
libxml2-2.9.1-6.el7.4.ppc64le.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64le.rpm
libxml2-python-2.9.1-6.el7.4.ppc64le.rpm
s390x:
libxml2-2.9.1-6.el7.4.s390.rpm
libxml2-2.9.1-6.el7.4.s390x.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-devel-2.9.1-6.el7.4.s390.rpm
libxml2-devel-2.9.1-6.el7.4.s390x.rpm
libxml2-python-2.9.1-6.el7.4.s390x.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-static-2.9.1-6.el7.4.ppc.rpm
libxml2-static-2.9.1-6.el7.4.ppc64.rpm
ppc64le:
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-static-2.9.1-6.el7.4.ppc64le.rpm
s390x:
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-static-2.9.1-6.el7.4.s390.rpm
libxml2-static-2.9.1-6.el7.4.s390x.rpm
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2015-8035
https://access.redhat.com/security/cve/CVE-2016-5131
https://access.redhat.com/security/cve/CVE-2017-15412
https://access.redhat.com/security/cve/CVE-2017-18258
https://access.redhat.com/security/cve/CVE-2018-14404
https://access.redhat.com/security/cve/CVE-2018-14567
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXoOdR9zjgjWX9erEAQhgbQ/+JolcknqNffv7HQZNxYOtS/M2Zx/E3IB4
QwmkXhfmgV44ig4prUpghE/+O5eTUPjqSq6rHjih/pjCjG4bVcK6BptxBFi7WQwo
GM0ryvm0p0fib0dy+Ov3NNC6Dhg32NIVwC0pWTIEdYcOGBfDY3mXlLXx5aHefisu
p1C7F6rP4xxMRDOlQhAB4UPMkPSD/MtKIyxIEqiAT5olybSTl0um2AB5XtLlCbkT
h4IXDsAyswvBIS/bxnyZkn6oHEiD3JBwcP+ZU0jgSEy34O92ttV7hRQb1H1+YHOO
li1bX5IcbmFzATwBfCZQmNfrp/XU4Ra28GT/3JGntnhhxFmz1xe/h5YNJTwZ+0TX
yxKZdAz3brm/mt6uvbY4PpGERyA+X/Moz4ToXCEL2jVfSXbOuajRtCV8Cp3X7bCd
Ed2imuXZQPpUXNVdF73RJ7YB6vEhQRIdlKgEXzPPpuHFH1HprvSLoJyrDD1T8bfx
TVrrmvtWKtXq0DYSD7wGw23WZJJeUIgyKiZNTlIxvb0c7r8+aZ+toY07sZlBkTCA
cjWNRnHDNkdYH2ZoNPQlzYzk5rSYGqhoOvF85pNCY4v4fofyMEnyAY7MEZ/Z991X
Ko2ShKSzEtKSMcx2B2wPg+hFcACP8HbKxSbW3SzoCSKCOGEAPLQlJ5eHXwLOAO3Q
IZIK7xZywNw=
=8RZh
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXoQ+tmaOgq3Tt24GAQgr3BAA0JwhSLJkYW71xnik15EJPFt3xBlVCfk/
NTVCVx3zeVdFUNHeQA1Vyt7y+7NRyesDOhnzOo8nsLr/Gi7Feuktvdh9jdZBQh8S
PPF9vsmybWrjEEG6OvYyqzCrizMAfERdkHzTuE5iVoTRrPWJx9IFeafA2QEjwVFQ
jm/KZHjCnecKcKfFjJLbae7DtpXuXNljKwvWIRvudfu4cv26Pb8BLQ0iAei38mV9
4vXJq8bbKAOnNyqZ7FDzKxjyEc8h68TqD8KhMkOJUQUaLEQwU4N9BXYMBKJqkLyP
vBr/xzWzyGLXCNC39aMn17w5u3jfI957nTje7SkhSg2Cs7kC5oZv96V5FhiwlWeH
+V6K9UP6IxYNShp79ck75H/wRgHcK4EMMEsXDHJJ/hSWo/FAkEgqxlDHlKwV/w0q
dRoDcR1QBf90FTwfIT4H1tv2n8QwrkW8WqkyEk9R4aJVFw640pFZrRwSU11caQn8
WYzDZXsUZX9CVfyHo+DfM8lo11uhrBG8kgbWBzFf6NvrV5Y18wkpxmmgj8sl6pge
XtTgHFil8zTxvZxVMfCw17sX9lQ+usDDm7BVu0N6QWFzm3ixC+t7+AjNihVclWdf
VuQfLRiDoUGt2vvfSFtg4k6pTp7eW/n8FNZ60uavk95wHSayL4g9daP09M+5KMLm
z6p3jpUMbuo=
=hEvq
-----END PGP SIGNATURE-----