Medium: libxml2

Issue Overview:

A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.

The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.

libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.

A heap-based buffer overflow vulnerability was found in xmlDictComputeFastQKey in dict.c.

A heap-based buffer overflow read in xmlParseMisc was found.

A heap-based buffer overflow was found in xmlGROW allowing the attacker to read the memory out of bounds.

A buffer overread in xmlNextChar was found, causing segmentation fault when compiled with ASAN.

Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behaviour.

Stack-based buffer overread vulnerability with HTML parser in push mode in xmlSAX2TextNode causing segmentation fault when compiled with ASAN.

A vulnerability in libxml2 was found causing DoS by exhausting CPU when parsing specially crafted XML document.

An out-of-bounds heap read in xmlParseXMLDecl happens when a file containing unfinished xml declaration.

Affected Packages:

libxml2

Issue Correction:
Run yum update libxml2 to update your system.

New Packages:

i686:  
    libxml2-2.9.1-6.2.50.amzn1.i686  
    libxml2-debuginfo-2.9.1-6.2.50.amzn1.i686  
    libxml2-python26-2.9.1-6.2.50.amzn1.i686  
    libxml2-python27-2.9.1-6.2.50.amzn1.i686  
    libxml2-devel-2.9.1-6.2.50.amzn1.i686  
    libxml2-static-2.9.1-6.2.50.amzn1.i686  
  
src:  
    libxml2-2.9.1-6.2.50.amzn1.src  
  
x86_64:  
    libxml2-static-2.9.1-6.2.50.amzn1.x86_64  
    libxml2-python27-2.9.1-6.2.50.amzn1.x86_64  
    libxml2-debuginfo-2.9.1-6.2.50.amzn1.x86_64  
    libxml2-2.9.1-6.2.50.amzn1.x86_64  
    libxml2-python26-2.9.1-6.2.50.amzn1.x86_64  
    libxml2-devel-2.9.1-6.2.50.amzn1.x86_64  

Additional References

Red Hat: CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317

Mitre: CVE-2015-1819, CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7941, CVE-2015-7942, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317