Detections
Analytics

Mandriva Linux Security Advisory : expat (MDVSA-2009:316-3)

medium Nessus Plugin ID 43019

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A vulnerability has been found and corrected in expat :

The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720 (CVE-2009-3560).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides a solution to these vulnerabilities.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

Update :

The previous (MDVSA-2009:316-2) updates provided packages for 2008.0/2009.0/2009.1/2010.0/mes5 that did not have an increased release number which prevented the packages from hitting the mirrors.

Solution

Update the affected packages.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=566434

Plugin Details

Severity: Medium

ID: 43019

File Name: mandriva_MDVSA-2009-316.nasl

Version: 1.19

Type: local

Published: 12/7/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:expat, p-cpe:/a:mandriva:linux:lib64expat1, p-cpe:/a:mandriva:linux:lib64expat1-devel, p-cpe:/a:mandriva:linux:libexpat1, p-cpe:/a:mandriva:linux:libexpat1-devel, cpe:/o:mandriva:linux:2008.0, cpe:/o:mandriva:linux:2009.0, cpe:/o:mandriva:linux:2009.1, cpe:/o:mandriva:linux:2010.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 1/10/2010

Reference Information

CVE: CVE-2009-3560

BID: 37203

CWE: 119

MDVSA: 2009:316-3