Univention Bugzilla – Bug 53269
libxml2: Multiple issues (4.4)
Last modified: 2021-05-19 18:01:10 CEST
New Debian libxml2 2.9.4+dfsg1-2.2+deb9u4 fixes: This update addresses the following issues: * use-after-free in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3516) * heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c (CVE-2021-3517) * use-after-free in xmlXIncludeDoProcess() in xinclude.c (CVE-2021-3518) * NULL pointer dereference when post-validating mix content parsed in recovery mode (CVE-2021-3537)
--- mirror/ftp/4.4/unmaintained/4.4-6/source/libxml2_2.9.4+dfsg1-2.2+deb9u3.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/libxml2_2.9.4+dfsg1-2.2+deb9u4.dsc @@ -1,3 +1,11 @@ +2.9.4+dfsg1-2.2+deb9u4 [Mon, 10 May 2021 11:50:45 +0200] Emilio Pozuelo Monfort <pochu@debian.org>: + + * Non-maintainer upload by the LTS team. + * CVE-2021-3516: use-after-free in xmlEncodeEntitiesInternal + * CVE-2021-3517: heap-based buffer overflow in xmlEncodeEntitiesInternal + * CVE-2021-3518: use-after-free in xmlXIncludeDoProcess + * CVE-2021-3537: NULL pointer dereference in xmlValidBuildAContentModel + 2.9.4+dfsg1-2.2+deb9u3 [Wed, 09 Sep 2020 22:06:27 +0200] Markus Koschany <apo@debian.org>: * Non-maintainer upload by the LTS team. <http://piuparts.knut.univention.de/4.4-8/#4482584142248261672>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] 66ffc08e95 Bug #53269: libxml2 2.9.4+dfsg1-2.2+deb9u4 doc/errata/staging/libxml2.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x976>