Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : python2.5 vulnerabilities (USN-890-2)

Ubuntu Security Notice (C) 2010-2014 Canonical, Inc. / NASL script (C) 2010-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

USN-890-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for the PyExpat module in Python 2.5.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat
did not properly process malformed XML. If a user or application
linked against Expat were tricked into opening a crafted XML file, an
attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process
malformed UTF-8 sequences. If a user or application linked
against Expat were tricked into opening a crafted XML file,
an attacker could cause a denial of service via application
crash. (CVE-2009-3560).

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 44115 ()

Bugtraq ID: 36097
37203

CVE ID: CVE-2009-2625
CVE-2009-3560
CVE-2009-3720