openSUSE-SU-2013:0729

openSUSE-SU-2013:0945

53061

[oss-security] 20130417 CVE request : libxml2 Multiple Use-After-Free Vulnerabilities

[oss-security] 20130418 Re: CVE request : libxml2 Multiple Use-After-Free Vulnerabilities

USN-1817-1

https://bugzilla.gnome.org/show_bug.cgi?id=690202

https://git.gnome.org/browse/libxml2/commit/?id=de0cc20c29cb3f056062925395e0f68d2250a46f

The remote Solaris system is missing necessary patches to address security updates :

  - Multiple use-after-free vulnerabilities in libxml2 2.9.0     and possibly other versions might allow     context-dependent attackers to cause a denial of service     (crash) and possibly execute arbitrary code via vectors     related to the (1) htmlParseChunk and (2) xmldecl_done     functions, as demonstrated by a buffer overflow in the     xmlBufGetInputBase function. (CVE-2013-1969)

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

- fix for CVE-2013-1969 (bnc#815665)

  - libxml2-CVE-2013-1969.patch

The remote host is affected by the vulnerability described in GLSA-201311-06 (libxml2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxml2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       document with an application linked against libxml2, possibly resulting       in execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that libxml2 incorrectly handled memory management when parsing certain XML files. An attacker could use this flaw to cause libxml2 to crash, resulting in a denial of service, or to possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80691	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_1969_resource_management)	Nessus	Solaris Local Security Checks	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
74982	openSUSE Security Update : libxml2 (openSUSE-SU-2013:0945-1)	Nessus	SuSE Local Security Checks	high
70836	GLSA-201311-06 : libxml2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66346	Ubuntu 13.04 : libxml2 vulnerability (USN-1817-1)	Nessus	Ubuntu Local Security Checks	high

CVE-2013-1969

high

Tenable Plugins

high

critical

high

high

high