[SECURITY] [DSA 1666-1] New libxml2 packages fix several vulnerabilities

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] [DSA 1666-1] New libxml2 packages fix several vulnerabilities
From: Moritz Muehlenhoff <jmm@xxxxxxxxxx>
Date: Tue, 18 Nov 2008 00:34:04 +0100
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mail-followup-to: bugtraq@xxxxxxxxxxxxxxxxx
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Old-return-path: <jmm@xxxxxxxxxx>
Priority: urgent
Reply-to: listadmin@xxxxxxxxxxxxxxxxx
Resent-cc: recipient list not shown: ;
Resent-date: Mon, 17 Nov 2008 23:34:24 +0000 (UTC)
Resent-from: list@xxxxxxxxxxxxxxxx (Mailing List Manager)
Resent-message-id: <aDuXNkx73iP.A.lSE.A-fIJB@liszt>
User-agent: Mutt/1.5.18 (2008-05-17)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1666-1                  security@xxxxxxxxxx
http://www.debian.org/security/                       Moritz Muehlenhoff
November 17, 2008                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : libxml2
Vulnerability  : several
Problem type   : local(remote)
Debian-specific: no
CVE Id(s)      : CVE-2008-4225 CVE-2008-4226

Several vulnerabilities have been discovered in the GNOME XML library.
The Common Vulnerabilities and Exposures project identifies the 
following problems:

CVE-2008-4225

    Drew Yao discovered that missing input sanitising in the
    xmlBufferResize() function may lead to an infinite loop,
    resulting in denial of service.

CVE-2008-4226

    Drew Yao discovered that an integer overflow in the
    xmlSAX2Characters() function may lead to denial of service or
    the execution of arbitrary code.

For the stable distribution (etch), these problems have been fixed in
version 2.6.27.dfsg-6.

For the upcoming stable distribution (lenny) and the unstable
distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your libxml2 packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, 
mipsel, powerpc, s390 and sparc.

Source archives:

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc
    Size/MD5 checksum:      893 b6b2006ffadfb999e72974d574814b7c
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz
    Size/MD5 checksum:  3416175 5ff71b22f6253a6dd9afc1c34778dec3
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz
    Size/MD5 checksum:   147867 d6a3bbbe39bffe96867de82b11c7c5be

Architecture independent packages:

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb
    Size/MD5 checksum:  1328280 c2990030601040775b909c8ace076100

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb
    Size/MD5 checksum:   881946 38629543e71a18f6007b8d61d0500e36
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb
    Size/MD5 checksum:   821150 f14ee677bb7eac20cd65adef90af0f3c
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb
    Size/MD5 checksum:    37972 d7757b07f8b0c69f9fd0a07a1598a3e3
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb
    Size/MD5 checksum:   184750 020e5ca7663ee88695e1502c8e8af77c
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb
    Size/MD5 checksum:   917020 f837c687d428d94559bf68e012bc0e02

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb
    Size/MD5 checksum:   745790 94edf60cc7d02dd31a70376baf740958
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb
    Size/MD5 checksum:   892010 a648a6d69a73593739035d78ed3c8436
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb
    Size/MD5 checksum:   796410 9f38a5028c33f32cf1701535c1c37984
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb
    Size/MD5 checksum:    36682 4de1bfa28b9361e462075451befbe66c
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb
    Size/MD5 checksum:   184126 1aae3163d718d0c378203b7ea1a53a9b

arm architecture (ARM)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb
    Size/MD5 checksum:   673236 cda6995615db6e74610d8a51607e85e4
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb
    Size/MD5 checksum:   817602 c5f81e370d055ba14a40a64d3fbb6e9e
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb
    Size/MD5 checksum:    34682 4b01403ce80c2949f31559e0eacc044b
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb
    Size/MD5 checksum:   165284 f84251cc53fa6b67b7fb55f58dd47d5b
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb
    Size/MD5 checksum:   742176 2e9e6cbbc777d49a99d8a6d98c5dc799

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb
    Size/MD5 checksum:   858220 0f8cf389ab60a7639fac0f6499325995
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb
    Size/MD5 checksum:   863998 2332655d5ec188cf038cf9fcab862d9f
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb
    Size/MD5 checksum:   850370 6c600a26f96c3a3eea898821b0a63937
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb
    Size/MD5 checksum:    36852 75d6a8790e01eacb3183e6f295542215
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb
    Size/MD5 checksum:   192850 f635c62c33d9a2ea17015b08370dfd8f

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb
    Size/MD5 checksum:   857246 6cebb1b5f8e5e87c00319eb59df9c497
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb
    Size/MD5 checksum:   169026 31acf12efa0a8f37045f3f0869b894f8
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb
    Size/MD5 checksum:   681544 f0f383f2ea6ae309bfbcd13f2a2e8efa
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb
    Size/MD5 checksum:   756128 f776e4a0c28389602bb6b26965fc70ce
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb
    Size/MD5 checksum:    34496 0cf1427860bb36162af23351285ff091

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb
    Size/MD5 checksum:   196528 3eaa55301a20961852f3a3c5b64bde8c
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb
    Size/MD5 checksum:    48494 280c616ff34b4aa41a48173828b6e66c
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb
    Size/MD5 checksum:  1106616 e7b32b8f711337ca52a041af581a05b6
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb
    Size/MD5 checksum:  1080448 a7334ed64dba73272b2001e09d18493f
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb
    Size/MD5 checksum:   874194 1410e29414572197b6f82dd5a8be061f

mips architecture (MIPS (Big Endian))

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb
    Size/MD5 checksum:   840690 ad2ce083ff5c14656ea3ae28b0fa783d
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb
    Size/MD5 checksum:   770540 d1faeaa723c3de301fb4c8a44ece376a
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb
    Size/MD5 checksum:    34424 c7c9469462957365ab26e7f06e1f0521
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb
    Size/MD5 checksum:   171674 5e6f7cbe84d053bd19dda54346330f75
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb
    Size/MD5 checksum:   926930 c4a3402711ebb05f38b1146eebcd0a71

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb
    Size/MD5 checksum:    34396 79f5ff849d9a0ed01ab567ec542b7f3e
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb
    Size/MD5 checksum:   898480 c195cceafe5efce1de168475a462be54
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb
    Size/MD5 checksum:   769244 d0d36bff7e63adf76857166c3ed10daa
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb
    Size/MD5 checksum:   168696 3667deae6585a788c4da731b4fc9383d
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb
    Size/MD5 checksum:   833258 4b1612f79d4b9d1ce2d7086fbb8edbd0

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb
    Size/MD5 checksum:   780124 0d2ed3ecc5a1e7a5ce3870fab1bcfc43
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb
    Size/MD5 checksum:   172736 2011f174234c5e939cebeedc2fd9e707
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb
    Size/MD5 checksum:    37662 94991d67033b1b921bb72e5d7bf2b844
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb
    Size/MD5 checksum:   898080 321d90790cf68bc046b9b577e7986438
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb
    Size/MD5 checksum:   771124 47b6d53839ea42f54ae6ad2b89594a26

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb
    Size/MD5 checksum:    36368 fbc5505f4471c4c2fe6ad41903c5596f
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb
    Size/MD5 checksum:   885484 ead63bcf342e568c9c338c2772ea4e0d
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb
    Size/MD5 checksum:   750248 ed7465c981212e90fac94dc040ac6bb4
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb
    Size/MD5 checksum:   185718 414512cb0af24a7c5e3622b75ef9b56f
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb
    Size/MD5 checksum:   806342 0f85b6120fdba835eaf39d02b4a606d9

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb
    Size/MD5 checksum:    34578 dd02c5498d378ee75330f8f93b2eb3a7
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb
    Size/MD5 checksum:   781490 ecf288ea66fc19e8f9874b90884a888e
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb
    Size/MD5 checksum:   713214 434a8a91f3a4acbfc3df2a2707acbbe0
  
http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb
    Size/MD5 checksum:   759786 83ba89269fd32296c48c8498e100372b
  
http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb
    Size/MD5 checksum:   176878 9840698d19580fe86bfc55a2347361e5

  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkh/toACgkQXm3vHE4uylrA7QCeOrg7IGAYqMSs1zh4r83vykT8
/wcAn15KByQrhQVyIVmYM92GvpOn0NJg
=0ZjW
-----END PGP SIGNATURE-----
Prev by Date: [USN-672-1] ClamAV vulnerability
Next by Date: [ MDVSA-2008:230 ] firefox
Previous by thread: [USN-672-1] ClamAV vulnerability
Next by thread: [ MDVSA-2008:230 ] firefox
Index(es):
- Date
- Thread