Univention Bugzilla – Bug 38908
libxml2: Denial of service (3.2)
Last modified: 2016-02-04 16:35:36 CET
+++ This bug was initially created as a clone of Bug #38907 +++ * denial of service processing a crafted XML document (CVE-2015-1819) A patch for this is available in Debian package version 2.7.8.dfsg-2+squeeze12
Fixed in 2.7.8.dfsg-2+squeeze14: * out-of-bounds memory access (CVE-2015-7941) * heap-buffer-overflow in xmlParseConditionalSections (CVE-2015-7942) * DoS if xz enabled (CVE-2015-8035)
CVE-2015-8035 doesn't affect the squeeze version.
Upstream Debian package version 2.7.8.dfsg-2+squeeze16 fixes the following additional issues: * Denial of service (CPU consumption) in xmlStringLenDecodeEntities when processing specially crafted XML input (CVE-2015-5312) * Denial of service due to heap-based buffer overflow in the xmlDictComputeFastQKey (CVE-2015-7497) * Denial of service due to heap-based buffer overflow in xmlParseXmlDecl (CVE-2015-7498) * Information discosure due to heap-based buffer overflow in the xmlGROW (CVE-2015-7499) * Denial of service due to out-of-bounds heap read in xmlParseMisc (CVE-2015-7500) * Denial of service (heap-based buffer over-read and application crash) via crafted XML data due to Buffer overread with XML parser in xmlNextChar (CVE-2015-8241) * Out-of-bounds heap read when parsing file with unfinished xml declaration (CVE-2015-8317) The Debian Security Advisory summarizes all of these issues as: "A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application."
Tests: OK Advisory: libxml2.yaml
OK: DEBIAN_FRONTEND=noninteractive apt-get install libxml2-utils OK: advisory OK: manual tests: # xmllint --repeat --noout sync/ucs.xml # wget -q http://www.wikipedia.org -O - | xmllint --html --valid --noout -
<http://errata.software-univention.de/ucs/3.2/397.html>