Comment 1 Arvid Requate 2015-11-17 13:48:09 CET

* out-of-bounds memory access (CVE-2015-7941)
* heap-buffer-overflow in xmlParseConditionalSections (CVE-2015-7942)
* DoS if xz enabled (CVE-2015-8035)

Comment 2 Arvid Requate 2016-01-05 18:33:52 CET

Upstream Debian package version 2.8.0+dfsg1-7+wheezy5 fixes all of the above and the following additional issues.

* Denial of service (CPU consumption) in xmlStringLenDecodeEntities when processing specially crafted XML input (CVE-2015-5312)

* Denial of service due to heap-based buffer overflow in the xmlDictComputeFastQKey (CVE-2015-7497)

* Denial of service due to heap-based buffer overflow in xmlParseXmlDecl (CVE-2015-7498)

* Information discosure due to heap-based buffer overflow in the xmlGROW (CVE-2015-7499)

* Denial of service due to out-of-bounds heap read in xmlParseMisc (CVE-2015-7500)

* Denial of service (heap-based buffer over-read and application crash) via crafted XML data due to Buffer overread with XML parser in xmlNextChar (CVE-2015-8241)

* Out-of-bounds heap read when parsing file with unfinished xml declaration (CVE-2015-8317)

The Debian Security Advisory summarizes all of these issues as:

"A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or
crash the application."

Comment 3 Janek Walkenhorst 2016-01-28 18:19:19 CET

Tests: OK
Advisory: libxml2.yaml

Comment 4 Daniel Tröder 2016-02-03 12:13:13 CET

OK: DEBIAN_FRONTEND=noninteractive apt-get install libxml2-utils
OK: advisory
OK: manual tests:
# xmllint --repeat --noout sync/ucs.xml
# wget -q http://www.wikipedia.org -O - | xmllint --html --valid --noout -

Comment 5 Janek Walkenhorst 2016-02-05 14:35:18 CET

<http://errata.software-univention.de/ucs/4.0/399.html>