[SECURITY] [DLA 503-1] libxml2 security update

2016-06-0319:22:01

lists.debian.org

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.4%

JSON

Package : libxml2
Version : 2.8.0+dfsg1-7+wheezy6
CVE ID : CVE-2015-8806 CVE-2016-1762 CVE-2016-1833 CVE-2016-1834
CVE-2016-1835 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839
CVE-2016-1840 CVE-2016-2073 CVE-2016-3627 CVE-2016-3705
CVE-2016-4447 CVE-2016-4449 CVE-2016-4483
Debian Bug : 812807 813613 819006 823405 823414

Several vulnerabilities were discovered in libxml2, a library providing
support to read, modify and write XML and HTML files. A remote attacker
could provide a specially crafted XML or HTML file that, when processed
by an application using libxml2, would cause a denial-of-service against
the application, or potentially the execution of arbitrary code with the
privileges of the user running the application.

For Debian 7 "Wheezy", these problems have been fixed in version
2.8.0+dfsg1-7+wheezy6.

We recommend that you upgrade your libxml2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-amd64libxml2-utils< 2.9.1+dfsg1-5+deb8u2libxml2-utils_2.9.1+dfsg1-5+deb8u2_kfreebsd-amd64.deb
Debian7armelpython-libxml2-dbg< 2.8.0+dfsg1-7+wheezy6python-libxml2-dbg_2.8.0+dfsg1-7+wheezy6_armel.deb
Debian8armellibxml2-utils-dbg< 2.9.1+dfsg1-5+deb8u2libxml2-utils-dbg_2.9.1+dfsg1-5+deb8u2_armel.deb
Debian7amd64libxml2-utils< 2.8.0+dfsg1-7+wheezy6libxml2-utils_2.8.0+dfsg1-7+wheezy6_amd64.deb
Debian8armhflibxml2-dbg< 2.9.1+dfsg1-5+deb8u2libxml2-dbg_2.9.1+dfsg1-5+deb8u2_armhf.deb
Debian8amd64libxml2-dbg< 2.9.1+dfsg1-5+deb8u2libxml2-dbg_2.9.1+dfsg1-5+deb8u2_amd64.deb
Debian8mipsellibxml2-dev< 2.9.1+dfsg1-5+deb8u2libxml2-dev_2.9.1+dfsg1-5+deb8u2_mipsel.deb
Debian8armellibxml2-utils< 2.9.1+dfsg1-5+deb8u2libxml2-utils_2.9.1+dfsg1-5+deb8u2_armel.deb
Debian8ppc64elpython-libxml2< 2.9.1+dfsg1-5+deb8u2python-libxml2_2.9.1+dfsg1-5+deb8u2_ppc64el.deb
Debian8amd64libxml2< 2.9.1+dfsg1-5+deb8u2libxml2_2.9.1+dfsg1-5+deb8u2_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-amd64	libxml2-utils	< 2.9.1+dfsg1-5+deb8u2	libxml2-utils_2.9.1+dfsg1-5+deb8u2_kfreebsd-amd64.deb
Debian	7	armel	python-libxml2-dbg	< 2.8.0+dfsg1-7+wheezy6	python-libxml2-dbg_2.8.0+dfsg1-7+wheezy6_armel.deb
Debian	8	armel	libxml2-utils-dbg	< 2.9.1+dfsg1-5+deb8u2	libxml2-utils-dbg_2.9.1+dfsg1-5+deb8u2_armel.deb
Debian	7	amd64	libxml2-utils	< 2.8.0+dfsg1-7+wheezy6	libxml2-utils_2.8.0+dfsg1-7+wheezy6_amd64.deb
Debian	8	armhf	libxml2-dbg	< 2.9.1+dfsg1-5+deb8u2	libxml2-dbg_2.9.1+dfsg1-5+deb8u2_armhf.deb
Debian	8	amd64	libxml2-dbg	< 2.9.1+dfsg1-5+deb8u2	libxml2-dbg_2.9.1+dfsg1-5+deb8u2_amd64.deb
Debian	8	mipsel	libxml2-dev	< 2.9.1+dfsg1-5+deb8u2	libxml2-dev_2.9.1+dfsg1-5+deb8u2_mipsel.deb
Debian	8	armel	libxml2-utils	< 2.9.1+dfsg1-5+deb8u2	libxml2-utils_2.9.1+dfsg1-5+deb8u2_armel.deb
Debian	8	ppc64el	python-libxml2	< 2.9.1+dfsg1-5+deb8u2	python-libxml2_2.9.1+dfsg1-5+deb8u2_ppc64el.deb
Debian	8	amd64	libxml2	< 2.9.1+dfsg1-5+deb8u2	libxml2_2.9.1+dfsg1-5+deb8u2_amd64.deb