This update brings libxml2 to version 2.9.4.

These security issues were fixed :

  - CVE-2016-3627: The xmlStringGetNodeList function in     tree.c, when used in recovery mode, allowed     context-dependent attackers to cause a denial of service     (infinite recursion, stack consumption, and application     crash) via a crafted XML document (bsc#972335).

  - CVE-2016-1833: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1834,     CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840 (bsc#981108).

  - CVE-2016-1835: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document     (bsc#981109).

  - CVE-2016-1837: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1834, CVE-2016-1836, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840 (bsc#981111).

  - CVE-2016-1836: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1834, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840 (bsc#981110).

  - CVE-2016-1839: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1840 (bsc#981114).

  - CVE-2016-1838: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1839, and CVE-2016-1840 (bsc#981112).

  - CVE-2016-1840: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1839 (bsc#981115).

  - CVE-2016-4483: out-of-bounds read parsing an XML using     recover mode (bnc#978395).

  - CVE-2016-1834: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document, a     different vulnerability than CVE-2016-1833,     CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840 (bsc#981041).

  - CVE-2016-3705: The (1) xmlParserEntityCheck and (2)     xmlParseAttValueComplex functions in parser.c in libxml2     did not properly keep track of the recursion depth,     which allowed context-dependent attackers to cause a     denial of service (stack consumption and application     crash) via a crafted XML document containing a large     number of nested entity references (bsc#975947).

  - CVE-2016-1762: libxml2 allowed remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted XML document     (bsc#981040).

This non-security issue was fixed :

  - bnc#983288: Fix attribute decoding during XML schema     validation

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-545:01 advisory.

    This library allows to manipulate XML files. It includes support     to read, modify and write XML and HTML files. There is DTDs support     this includes parsing and validation even with complex DtDs, either     at parse time or later once the document has been modified. The output     can be a simple SAX stream or and in-memory DOM like representations.
    In this case one can use the built-in XPath and XPointer implementation     to select sub nodes or ranges. A flexible Input/Output mechanism is     available, with existing HTTP and FTP modules and combined to an     URI library.
    Security issues fixed with this release:
    CVE-2016-1762     libxml2 in Apple iOS before 9.3, OS X before 10.11.4, Safari before     9.1, tvOS before 9.2, and watchOS before 2.2 allows remote attackers     to execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document.
    CVE-2016-1833     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1834     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1835     libxml2, as used in Apple iOS before 9.3.2 and OS X before 10.11.5,     allows remote attackers to execute arbitrary code or cause a denial of     service (memory corruption) via a crafted XML document.
    CVE-2016-1836     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1837     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1838     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1839, and CVE-2016-1840.
    CVE-2016-1839     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1840.
    CVE-2016-1840     libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS     before 9.2.1, and watchOS before 2.2.1, allows remote attackers to     execute arbitrary code or cause a denial of service (memory     corruption) via a crafted XML document, a different vulnerability than     CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837,     CVE-2016-1838, and CVE-2016-1839.
    CVE-2016-3627     The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and     earlier, when used in recovery mode, allows context-dependent     attackers to cause a denial of service (infinite recursion, stack     consumption, and application crash) via a crafted XML document.
    CVE-2016-3705     The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions     in parser.c in libxml2 2.9.3 do not properly keep track of the     recursion depth, which allows context-dependent attackers to cause a     denial of service (stack consumption and application crash) via a     crafted XML document containing a large number of nested entity     references.
    CVE-2016-4447     The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4     allows context-dependent attackers to cause a denial of service     (heap-based buffer underread and application crash) via a crafted     file, involving xmlParseName.
    CVE-2016-4448     Format string vulnerability in libxml2 before 2.9.4 allows attackers     to have unspecified impact via format string specifiers in unknown     vectors.
    CVE-2016-4449     XML external entity (XXE) vulnerability in the     xmlStringLenDecodeEntities function in parser.c in libxml2 before     2.9.4, when not in validating mode, allows context-dependent attackers     to read arbitrary files or cause a denial of service (resource     consumption) via unspecified vectors.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

ID	Name	Product	Family	Published	Updated	Severity
91640	openSUSE Security Update : libxml2 (openSUSE-2016-734)	Nessus	SuSE Local Security Checks	6/17/2016	1/19/2021	high
289699	MiracleLinux 7 : libxml2-2.9.1-6.0.1.el7.AXS7.3 (AXSA:2016-545:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
91802	RHEL 6 / 7 : libxml2 (RHSA-2016:1292)	Nessus	Red Hat Local Security Checks	6/24/2016	4/8/2020	critical
91808	Scientific Linux Security Update : libxml2 on SL6.x, SL7.x i386/x86_64 (20160623)	Nessus	Scientific Linux Local Security Checks	6/24/2016	1/14/2021	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical