Scientific Linux Security Update : libxml2 on SL6.x i386/x86_64

This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.

Synopsis :

The remote Scientific Linux host is missing one or more security

Description :

It was discovered that libxml2 loaded external parameter entities even
when entity substitution was disabled. A remote attacker able to
provide a specially crafted XML file to an application linked against
libxml2 could use this flaw to conduct XML External Entity (XXE)
attacks, possibly resulting in a denial of service or an information
leak on the system. (CVE-2014-0191)

An out-of-bounds read flaw was found in the way libxml2 detected the
end of an XML file. A remote attacker could provide a specially
crafted XML file that, when processed by an application linked against
libxml2, could cause the application to crash. (CVE-2013-2877)

The desktop must be restarted (log out, then log back in) for this
update to take effect.

See also :

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 74103 ()

Bugtraq ID:

CVE ID: CVE-2013-2877