Lucene search

K
suseSuseSUSE-SU-2013:1625-1
HistoryNov 04, 2013 - 5:04 p.m.

Security update for libxml2 (important)

2013-11-0417:04:12
lists.opensuse.org
16

0.063 Low

EPSS

Percentile

92.9%

This is a LTSS rollup update for the libxml2 library that
fixes various security issues.

CVE-2013-2877: parser.c in libxml2 allowed remote
attackers to cause a denial of service (out-of-bounds read)
via a document that ends abruptly, related to the lack of
certain checks for the XML_PARSER_EOF state.

CVE-2013-0338: libxml2 allowed context-dependent
attackers to cause a denial of service (CPU and memory
consumption) via an XML file containing an entity
declaration with long replacement text and many references
to this entity, aka "internal entity expansion" with linear
complexity.

CVE-2012-5134: Heap-based buffer underflow in the
xmlParseAttValueComplex function in parser.c in libxml2
allowed remote attackers to cause a denial of service or
possibly execute arbitrary code via crafted entities in an
XML document.

CVE-2012-2807: Multiple integer overflows in libxml2
on 64-bit Linux platforms allowed remote attackers to cause
a denial of service or possibly have unspecified other
impact via unknown vectors.

CVE-2011-3102: Off-by-one error in libxml2 allowed
remote attackers to cause a denial of service
(out-of-bounds write) or possibly have unspecified other
impact via unknown vectors.

CVE-2012-0841: libxml2 computed hash values without
restricting the ability to trigger hash collisions
predictably, which allows context-dependent attackers to
cause a denial of service (CPU consumption) via crafted XML
data.

CVE-2011-3919: A heap-based buffer overflow during
decoding of entity references with overly long names has
been fixed.

0.063 Low

EPSS

Percentile

92.9%

Related for SUSE-SU-2013:1625-1