Lucene search
AmazonALAS-2014-341HistoryMay 21, 2014 - 10:31 a.m.
Medium: libxml2
2014-05-2110:31:00
alas.aws.amazon.com
22
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.7%
Issue Overview:
It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.
Affected Packages:
libxml2
Issue Correction:
Run yum update libxml2 to update your system.
New Packages:
i686:
libxml2-debuginfo-2.9.1-1.1.30.amzn1.i686
libxml2-python-2.9.1-1.1.30.amzn1.i686
libxml2-2.9.1-1.1.30.amzn1.i686
libxml2-devel-2.9.1-1.1.30.amzn1.i686
libxml2-static-2.9.1-1.1.30.amzn1.i686
src:
libxml2-2.9.1-1.1.30.amzn1.src
x86_64:
libxml2-debuginfo-2.9.1-1.1.30.amzn1.x86_64
libxml2-devel-2.9.1-1.1.30.amzn1.x86_64
libxml2-static-2.9.1-1.1.30.amzn1.x86_64
libxml2-2.9.1-1.1.30.amzn1.x86_64
libxml2-python-2.9.1-1.1.30.amzn1.x86_64
Additional References
Red Hat: CVE-2014-0191
Mitre: CVE-2014-0191
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | libxml2-debuginfo | < 2.9.1-1.1.30.amzn1 | libxml2-debuginfo-2.9.1-1.1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libxml2-python | < 2.9.1-1.1.30.amzn1 | libxml2-python-2.9.1-1.1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libxml2 | < 2.9.1-1.1.30.amzn1 | libxml2-2.9.1-1.1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libxml2-devel | < 2.9.1-1.1.30.amzn1 | libxml2-devel-2.9.1-1.1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | libxml2-static | < 2.9.1-1.1.30.amzn1 | libxml2-static-2.9.1-1.1.30.amzn1.i686.rpm |
| Amazon Linux | 1 | x86_64 | libxml2-debuginfo | < 2.9.1-1.1.30.amzn1 | libxml2-debuginfo-2.9.1-1.1.30.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libxml2-devel | < 2.9.1-1.1.30.amzn1 | libxml2-devel-2.9.1-1.1.30.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libxml2-static | < 2.9.1-1.1.30.amzn1 | libxml2-static-2.9.1-1.1.30.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libxml2 | < 2.9.1-1.1.30.amzn1 | libxml2-2.9.1-1.1.30.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | libxml2-python | < 2.9.1-1.1.30.amzn1 | libxml2-python-2.9.1-1.1.30.amzn1.x86_64.rpm |
Related
nessus
nessus
AIX 6.1 TL 9 : bos.rte.control (U861276)
2014-11-10 00:00:00
Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20150330)
2015-03-31 00:00:00
CentOS 7 : libxml2 (CESA-2015:0749)
2015-04-01 00:00:00
redhat
redhat
(RHSA-2015:0749) Moderate: libxml2 security update
2015-03-30 00:00:00
(RHSA-2014:0513) Moderate: libxml2 security update
2014-05-19 00:00:00
openvas
openvas
Fedora Update for mingw-libxml2 FEDORA-2014-17609
2015-01-05 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-341)
2015-09-08 00:00:00
Oracle Linux Local Check: ELSA-2015-0749
2015-10-06 00:00:00
freebsd
freebsd
libxml2 -- entity substitution DoS
2013-12-03 00:00:00
securityvulns
securityvulns
libxml2 DoS
2014-05-07 00:00:00
NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
2014-12-11 00:00:00
Apple iOS multiple security vulnerabilities
2015-08-17 00:00:00
cve
cve
gentoo
gentoo
libxml2: Denial of service
2014-09-19 00:00:00
ubuntu
ubuntu
libxml2 vulnerability
2014-05-15 00:00:00
debian
debian
[SECURITY] [DSA 2978-1] libxml2 security update
2014-07-11 14:29:53
[DLA-0016-1] libxml2 security update
2014-07-19 15:07:28
libxml2 security update
2014-07-19 14:43:46
ubuntucve
ubuntucve
CVE-2014-0191
2014-05-07 00:00:00
ibm
ibm
fedora
fedora
[SECURITY] Fedora 20 Update: mingw-libxml2-2.9.2-1.fc20
2015-01-02 05:01:49
[SECURITY] Fedora 21 Update: mingw-libxml2-2.9.2-1.fc21
2015-01-02 05:01:30
[SECURITY] Fedora 21 Update: libxml2-2.9.1-7.fc21
2015-04-07 07:30:19
prion
prion
Design/Logic Flaw
2015-01-21 14:59:00
Design/Logic Flaw
2015-01-21 18:59:00
debiancve
debiancve
CVE-2014-0191
2015-01-21 14:59:00
mageia
mageia
Updated libxml2 packages fix CVE-2014-0191
2014-05-10 23:46:24
Updated kdelibs4 packages fix security vulnerability and various bugs
2014-08-12 13:16:46
centos
centos
libxml2 security update
2015-04-01 03:26:34
libxml2 security update
2014-05-19 13:08:11
veracode
veracode
XML External Entities (XXE)
2018-08-06 02:11:43
aix
aix
AIX libxml2 vulnerability,VIOS libxml2 vulnerability
2014-08-15 10:26:30
oraclelinux
oraclelinux
libxml2 security update
2014-05-19 00:00:00
libxml2 security update
2015-03-30 00:00:00
libxml2 security update
2015-12-07 00:00:00
archlinux
archlinux
libxml2: Denial of service
2014-10-24 00:00:00
exploitpack
exploitpack
eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
2015-10-30 00:00:00
osv
osv
libxml2 - security update
2015-02-07 00:00:00
libxml2 - security update
2014-07-11 00:00:00
CVE-2016-9597
2018-07-30 14:29:02
exploitdb
exploitdb
eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection
2015-10-30 00:00:00
vmware
vmware
VMware vSphere product updates address security vulnerabilities
2014-12-04 00:00:00
VMware vSphere product updates address security vulnerabilities
2014-12-04 00:00:00
apple
apple
About the security content of Apple TV 7.2.1 - Apple Support
2017-01-23 03:54:31
About the security content of Apple TV 7.2.1
2016-02-25 00:00:00
suse
suse
Security update for SLES 12 Docker image (important)
2017-10-11 03:06:53
Security update for SLES 12-SP1 Docker image (important)
2017-10-11 03:07:32
oracle
oracle
Oracle Critical Patch Update Advisory - January 2015
2015-03-10 00:00:00
Oracle Critical Patch Update Advisory - October 2015
2015-10-20 00:00:00
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.7%
Related for ALAS-2014-341