Lucene search

K
centosCentOS ProjectCESA-2008:0988
HistoryNov 17, 2008 - 11:54 p.m.

libxml2 security update

2008-11-1723:54:51
CentOS Project
lists.centos.org
60

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.019

Percentile

88.4%

CentOS Errata and Security Advisory CESA-2008:0988

libxml2 is a library for parsing and manipulating XML files. It includes
support for reading, modifying, and writing XML and HTML files.

An integer overflow flaw causing a heap-based buffer overflow was found in
the libxml2 XML parser. If an application linked against libxml2 processed
untrusted, malformed XML content, it could cause the application to crash
or, possibly, execute arbitrary code. (CVE-2008-4226)

A denial of service flaw was discovered in the libxml2 XML parser. If an
application linked against libxml2 processed untrusted, malformed XML
content, it could cause the application to enter an infinite loop.
(CVE-2008-4225)

Red Hat would like to thank Drew Yao of the Apple Product Security team for
reporting these issues.

Users of libxml2 are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2008-November/077574.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077575.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077576.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077577.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077578.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077579.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077581.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077583.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077592.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077593.html
https://lists.centos.org/pipermail/centos-announce/2008-November/090341.html
https://lists.centos.org/pipermail/centos-announce/2008-November/090342.html

Affected packages:
libxml2
libxml2-devel
libxml2-python

Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0988

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.019

Percentile

88.4%