CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
88.4%
CentOS Errata and Security Advisory CESA-2008:0988
libxml2 is a library for parsing and manipulating XML files. It includes
support for reading, modifying, and writing XML and HTML files.
An integer overflow flaw causing a heap-based buffer overflow was found in
the libxml2 XML parser. If an application linked against libxml2 processed
untrusted, malformed XML content, it could cause the application to crash
or, possibly, execute arbitrary code. (CVE-2008-4226)
A denial of service flaw was discovered in the libxml2 XML parser. If an
application linked against libxml2 processed untrusted, malformed XML
content, it could cause the application to enter an infinite loop.
(CVE-2008-4225)
Red Hat would like to thank Drew Yao of the Apple Product Security team for
reporting these issues.
Users of libxml2 are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2008-November/077574.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077575.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077576.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077577.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077578.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077579.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077581.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077583.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077592.html
https://lists.centos.org/pipermail/centos-announce/2008-November/077593.html
https://lists.centos.org/pipermail/centos-announce/2008-November/090341.html
https://lists.centos.org/pipermail/centos-announce/2008-November/090342.html
Affected packages:
libxml2
libxml2-devel
libxml2-python
Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0988
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | libxml2 | <Β 2.6.26-2.1.2.7 | libxml2-2.6.26-2.1.2.7.i386.rpm |
CentOS | 5 | i386 | libxml2-devel | <Β 2.6.26-2.1.2.7 | libxml2-devel-2.6.26-2.1.2.7.i386.rpm |
CentOS | 5 | i386 | libxml2-python | <Β 2.6.26-2.1.2.7 | libxml2-python-2.6.26-2.1.2.7.i386.rpm |
CentOS | 5 | i386 | libxml2 | <Β 2.6.26-2.1.2.7 | libxml2-2.6.26-2.1.2.7.i386.rpm |
CentOS | 5 | x86_64 | libxml2 | <Β 2.6.26-2.1.2.7 | libxml2-2.6.26-2.1.2.7.x86_64.rpm |
CentOS | 5 | i386 | libxml2-devel | <Β 2.6.26-2.1.2.7 | libxml2-devel-2.6.26-2.1.2.7.i386.rpm |
CentOS | 5 | x86_64 | libxml2-devel | <Β 2.6.26-2.1.2.7 | libxml2-devel-2.6.26-2.1.2.7.x86_64.rpm |
CentOS | 5 | x86_64 | libxml2-python | <Β 2.6.26-2.1.2.7 | libxml2-python-2.6.26-2.1.2.7.x86_64.rpm |
CentOS | 3 | i386 | libxml2 | <Β 2.5.10-14 | libxml2-2.5.10-14.i386.rpm |
CentOS | 3 | i386 | libxml2-devel | <Β 2.5.10-14 | libxml2-devel-2.5.10-14.i386.rpm |