Executive Summary
Summary | |
---|---|
Title | libxml2 security update |
Informations | |||
---|---|---|---|
Name | RHSA-2016:1292 | First vendor Publication | 2016-06-23 |
Vendor | RedHat | Last vendor Modification | 2016-06-23 |
Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application. (CVE-2016-1834, CVE-2016-1840) Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications linked to the libxml2 library must be restarted, or the system rebooted. 5. Bugs fixed (https://bugzilla.redhat.com/): 1319829 - CVE-2016-3627 libxml2: stack exhaustion while parsing xml files in recovery mode 1332443 - CVE-2016-3705 libxml2: stack overflow before detecting invalid XML file 1338682 - CVE-2016-1833 libxml2: Heap-based buffer overread in htmlCurrentChar 1338686 - CVE-2016-4447 libxml2: Heap-based buffer underreads due to xmlParseName 1338691 - CVE-2016-1835 libxml2: Heap use-after-free in xmlSAX2AttributeNs 1338696 - CVE-2016-1837 libxml2: Heap use-after-free in htmlPArsePubidLiteral and htmlParseSystemiteral 1338700 - CVE-2016-4448 libxml2: Format string vulnerability 1338701 - CVE-2016-4449 libxml2: Inappropriate fetch of entities content 1338702 - CVE-2016-1836 libxml2: Heap use-after-free in xmlDictComputeFastKey 1338703 - CVE-2016-1839 libxml2: Heap-based buffer overread in xmlDictAddString 1338705 - CVE-2016-1838 libxml2: Heap-based buffer overread in xmlPArserPrintFileContextInternal 1338706 - CVE-2016-1840 libxml2: Heap-buffer-overflow in xmlFAParserPosCharGroup 1338708 - CVE-2016-1834 libxml2: Heap-buffer-overflow in xmlStrncat 1338711 - CVE-2016-1762 libxml2: Heap-based buffer-overread in xmlNextChar |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2016-1292.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
36 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
21 % | CWE-125 | Out-of-bounds Read |
14 % | CWE-416 | Use After Free |
14 % | CWE-20 | Improper Input Validation |
7 % | CWE-674 | Uncontrolled Recursion |
7 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2019-01-11 | Name : The remote device is missing a vendor-supplied security patch. File : juniper_jsa10916.nasl - Type : ACT_GATHER_INFO |
2017-12-14 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_76e59f554f7a4887bcb011604004163a.nasl - Type : ACT_GATHER_INFO |
2017-06-09 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-663.nasl - Type : ACT_GATHER_INFO |
2017-05-31 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1454-1.nasl - Type : ACT_GATHER_INFO |
2017-04-20 | Name : The remote Fedora host is missing a security update. File : fedora_2017-be8574d593.nasl - Type : ACT_GATHER_INFO |
2017-04-20 | Name : The remote Fedora host is missing a security update. File : fedora_2017-a3a47973eb.nasl - Type : ACT_GATHER_INFO |
2017-03-22 | Name : A data aggregation application installed on the remote host is affected by mu... File : lce_4_8_1.nasl - Type : ACT_GATHER_INFO |
2017-03-17 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3235-1.nasl - Type : ACT_GATHER_INFO |
2017-01-17 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201701-37.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL54225343.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL14338030.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL71926235.nasl - Type : ACT_GATHER_INFO |
2016-12-20 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL48220300.nasl - Type : ACT_GATHER_INFO |
2016-12-20 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL26422113.nasl - Type : ACT_GATHER_INFO |
2016-12-20 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL24322529.nasl - Type : ACT_GATHER_INFO |
2016-12-20 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16712298.nasl - Type : ACT_GATHER_INFO |
2016-12-20 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL14614344.nasl - Type : ACT_GATHER_INFO |
2016-08-29 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1604-1.nasl - Type : ACT_GATHER_INFO |
2016-08-29 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_e195679d045b4953bb33be0073ba2ac6.nasl - Type : ACT_GATHER_INFO |
2016-07-21 | Name : The remote device is affected by multiple vulnerabilities. File : appletv_9_2_2.nasl - Type : ACT_GATHER_INFO |
2016-07-21 | Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_SecUpd2016-004.nasl - Type : ACT_GATHER_INFO |
2016-07-21 | Name : The remote host is missing a Mac OS X security update that fixes multiple vul... File : macosx_10_11_6.nasl - Type : ACT_GATHER_INFO |
2016-07-19 | Name : The remote host contains an application that is affected by multiple vulnerab... File : itunes_12_4_2.nasl - Type : ACT_GATHER_INFO |
2016-07-19 | Name : The remote host is running an application that is affected by multiple vulner... File : itunes_12_4_2_banner.nasl - Type : ACT_GATHER_INFO |
2016-07-15 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2016-719.nasl - Type : ACT_GATHER_INFO |
2016-06-24 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160623_libxml2_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-06-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-1292.nasl - Type : ACT_GATHER_INFO |
2016-06-24 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2016-0087.nasl - Type : ACT_GATHER_INFO |
2016-06-24 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-1292.nasl - Type : ACT_GATHER_INFO |
2016-06-24 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-1292.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1538-1.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-734.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-733.nasl - Type : ACT_GATHER_INFO |
2016-06-07 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2994-1.nasl - Type : ACT_GATHER_INFO |
2016-06-06 | Name : The remote Debian host is missing a security update. File : debian_DLA-503.nasl - Type : ACT_GATHER_INFO |
2016-06-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3593.nasl - Type : ACT_GATHER_INFO |
2016-06-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-662.nasl - Type : ACT_GATHER_INFO |
2016-05-31 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-148-01.nasl - Type : ACT_GATHER_INFO |
2016-05-24 | Name : The remote device is affected by multiple vulnerabilities. File : appletv_9_2_1.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_SecUpd2016-003.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote Mac OS X host is affected by multiple vulnerabilities. File : macosx_10_11_5.nasl - Type : ACT_GATHER_INFO |
2016-05-16 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-583.nasl - Type : ACT_GATHER_INFO |
2016-05-04 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1205-1.nasl - Type : ACT_GATHER_INFO |
2016-05-04 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1204-1.nasl - Type : ACT_GATHER_INFO |
2016-04-01 | Name : The remote device is affected by multiple vulnerabilities. File : appletv_9_2.nasl - Type : ACT_GATHER_INFO |
2016-03-22 | Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_SecUpd2016-002.nasl - Type : ACT_GATHER_INFO |
2016-03-22 | Name : The remote Mac OS X host is affected by multiple vulnerabilities. File : macosx_10_11_4.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-06-25 13:27:14 |
|
2016-06-23 17:24:49 |
|