Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : libxml2 vulnerabilities (USN-1334-1)

Ubuntu Security Notice (C) 2012-2016 Canonical, Inc. / NASL script (C) 2012-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

It was discovered that libxml2 contained an off by one error. If a
user or application linked against libxml2 were tricked into opening a
specially crafted XML file, an attacker could cause the application to
crash or possibly execute arbitrary code with the privileges of the
user invoking the program. (CVE-2011-0216)

It was discovered that libxml2 is vulnerable to double-free conditions
when parsing certain XML documents. This could allow a remote attacker
to cause a denial of service. (CVE-2011-2821, CVE-2011-2834)

It was discovered that libxml2 did not properly detect end of file
when parsing certain XML documents. An attacker could exploit this to
crash applications linked against libxml2. (CVE-2011-3905)

It was discovered that libxml2 did not properly decode entity
references with long names. If a user or application linked against
libxml2 were tricked into opening a specially crafted XML file, an
attacker could cause the application to crash or possibly execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2011-3919).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libxml2 package.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.9
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 57615 ()

Bugtraq ID: 48832
49279
49658
51084
51300

CVE ID: CVE-2011-0216
CVE-2011-2821
CVE-2011-2834
CVE-2011-3905
CVE-2011-3919