Executive Summary
Summary | |
---|---|
Title | libxml2 security update |
Informations | |||
---|---|---|---|
Name | RHSA-2008:0836 | First vendor Publication | 2008-08-21 |
Vendor | RedHat | Last vendor Modification | 2008-08-21 |
Severity (Vendor) | Moderate | Revision | 02 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated libxml2 packages that fix a security issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The libxml2 packages provide a library that allows you to manipulate XML files. It includes support to read, modify, and write XML and HTML files. A denial of service flaw was found in the way libxml2 processes certain content. If an application linked against libxml2 processes malformed XML content, it could cause the application to stop responding. (CVE-2008-3281) Red Hat would like to thank Andreas Solberg for responsibly disclosing this issue. All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 458086 - CVE-2008-3281 libxml2 denial of service |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2008-0836.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-776 | Unrestricted Recursive Entity References in DTDs ('XML Bomb') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17731 | |||
Oval ID: | oval:org.mitre.oval:def:17731 | ||
Title: | USN-644-1 -- libxml2 vulnerabilities | ||
Description: | It was discovered that libxml2 did not correctly handle long entity names. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-644-1 CVE-2008-3529 CVE-2008-3281 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:17756 | |||
Oval ID: | oval:org.mitre.oval:def:17756 | ||
Title: | USN-640-1 -- libxml2 vulnerability | ||
Description: | Andreas Solberg discovered that libxml2 did not handle recursive entities safely. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-640-1 CVE-2008-3281 | Version: | 7 |
Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:19740 | |||
Oval ID: | oval:org.mitre.oval:def:19740 | ||
Title: | DSA-1631-1 libxml2 - denial of service | ||
Description: | Andreas Solberg discovered that libxml2, the GNOME XML library, could be forced to recursively evaluate entities, until available CPU and memory resources were exhausted. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1631-1 CVE-2008-3281 | Version: | 5 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libxml2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21731 | |||
Oval ID: | oval:org.mitre.oval:def:21731 | ||
Title: | ELSA-2008:0836: libxml2 security update (Moderate) | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2008:0836-04 CVE-2008-3281 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | libxml2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:29241 | |||
Oval ID: | oval:org.mitre.oval:def:29241 | ||
Title: | RHSA-2008:0836 -- libxml2 security update (Moderate) | ||
Description: | Updated libxml2 packages that fix a security issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The original fix used in this errata caused some applications using the libxml2 library in an unexpected way to crash when used with updated libxml2 packages. We have updated the packages for Red Hat Enterprise Linux 3, 4 and 5 to use a different fix that does not break affected applications. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2008:0836 CESA-2008:0836-CentOS 3 CESA-2008:0836-CentOS 2 CESA-2008:0836-CentOS 5 CVE-2008-3281 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 3 CentOS Linux 2 CentOS Linux 5 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:6496 | |||
Oval ID: | oval:org.mitre.oval:def:6496 | ||
Title: | Libxml2 Recursive Entity Evaluation Bug Lets Remote Users Deny Service | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-3281 | Version: | 3 |
Platform(s): | VMWare ESX Server 3 VMWare ESX Server 3.5 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7968 | |||
Oval ID: | oval:org.mitre.oval:def:7968 | ||
Title: | DSA-1631 libxml2 -- denial of service | ||
Description: | Andreas Solberg discovered that libxml2, the GNOME XML library, could be forced to recursively evaluate entities, until available CPU and memory resources were exhausted. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1631 CVE-2008-3281 | Version: | 3 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libxml2 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:9812 | |||
Oval ID: | oval:org.mitre.oval:def:9812 | ||
Title: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Description: | libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-3281 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-13 | Name : SLES10: Security update for libxml2 File : nvt/sles10_libxml2.nasl |
2009-10-10 | Name : SLES9: Security update for libxml2 File : nvt/sles9p5035440.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:180 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_180.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:180-1 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_180_1.nasl |
2009-04-09 | Name : Mandriva Update for libxml2 MDVSA-2008:192 (libxml2) File : nvt/gb_mandriva_MDVSA_2008_192.nasl |
2009-03-23 | Name : Ubuntu Update for libxml2 vulnerability USN-640-1 File : nvt/gb_ubuntu_USN_640_1.nasl |
2009-03-23 | Name : Ubuntu Update for libxml2 vulnerabilities USN-644-1 File : nvt/gb_ubuntu_USN_644_1.nasl |
2009-03-06 | Name : RedHat Update for libxml2 RHSA-2008:0836-02 File : nvt/gb_RHSA-2008_0836-02_libxml2.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836-02 centos2 i386 File : nvt/gb_CESA-2008_0836-02_libxml2_centos2_i386.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836 centos3 i386 File : nvt/gb_CESA-2008_0836_libxml2_centos3_i386.nasl |
2009-02-27 | Name : CentOS Update for libxml2 CESA-2008:0836 centos3 x86_64 File : nvt/gb_CESA-2008_0836_libxml2_centos3_x86_64.nasl |
2009-02-17 | Name : Fedora Update for libxml2 FEDORA-2008-7395 File : nvt/gb_fedora_2008_7395_libxml2_fc9.nasl |
2009-02-17 | Name : Fedora Update for libxml2 FEDORA-2008-7724 File : nvt/gb_fedora_2008_7724_libxml2_fc8.nasl |
2008-12-03 | Name : Gentoo Security Advisory GLSA 200812-06 (libxml2) File : nvt/glsa_200812_06.nasl |
2008-11-01 | Name : FreeBSD Ports: libxml2 File : nvt/freebsd_libxml20.nasl |
2008-09-04 | Name : Debian Security Advisory DSA 1631-1 (libxml2) File : nvt/deb_1631_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
47636 | libxml2 Crafted XML File Handling Recursion Limit DoS |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2008-11-06 | IAVM : 2008-B-0078 - Multiple Vulnerabilities in VMware Severity : Category I - VMSKEY : V0017874 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2009-0018.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080821_libxml2_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12237.nasl - Type : ACT_GATHER_INFO |
2009-07-27 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2008-0017.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_libxml2-080905.nasl - Type : ACT_GATHER_INFO |
2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : macosx_Safari4_0.nasl - Type : ACT_GATHER_INFO |
2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : safari_4.0.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-180.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-192.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-644-1.nasl - Type : ACT_GATHER_INFO |
2008-12-03 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200812-06.nasl - Type : ACT_GATHER_INFO |
2008-10-15 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_d71da2369a9411dd8f42001c2514716c.nasl - Type : ACT_GATHER_INFO |
2008-09-15 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libxml2-5583.nasl - Type : ACT_GATHER_INFO |
2008-09-15 | Name : The remote openSUSE host is missing a security update. File : suse_libxml2-5586.nasl - Type : ACT_GATHER_INFO |
2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7724.nasl - Type : ACT_GATHER_INFO |
2008-09-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-7395.nasl - Type : ACT_GATHER_INFO |
2008-09-05 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-640-1.nasl - Type : ACT_GATHER_INFO |
2008-08-27 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
2008-08-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1631.nasl - Type : ACT_GATHER_INFO |
2008-08-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0836.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:51:55 |
|