Univention Bugzilla – Bug 55371
libxml2: Multiple issues (5.0)
Last modified: 2022-11-02 16:47:16 CET
New Debian libxml2 2.9.4+dfsg1-7+deb10u5 fixes: This update addresses the following issues: * integer overflows with XML_PARSE_HUGE (CVE-2022-40303) * dict corruption caused by entity reference cycles (CVE-2022-40304)
--- mirror/ftp/pool/main/libx/libxml2/libxml2_2.9.4+dfsg1-7+deb10u4.dsc +++ apt/ucs_5.0-0-errata5.0-2/source/libxml2_2.9.4+dfsg1-7+deb10u5.dsc @@ -1,3 +1,17 @@ +2.9.4+dfsg1-7+deb10u5 [Sun, 30 Oct 2022 15:32:24 +0100] Markus Koschany <apo@debian.org>: + + * Non-maintainer upload by the LTS team. + * Fix CVE-2022-40303: + Parsing a XML document with the XML_PARSE_HUGE + option enabled can result in an integer overflow because safety checks were + missing in some functions. Also, the xmlParseEntityValue function didn't + have any length limitation. + * Fix CVE-2022-40304: + When a reference cycle is detected in the XML entity cleanup function the + XML entity data can be stored in a dictionary. In this case, the + dictionary becomes corrupted resulting in logic errors, including memory + errors like double free. + 2.9.4+dfsg1-7+deb10u4 [Sun, 15 May 2022 16:13:21 +0200] Salvatore Bonaccorso <carnil@debian.org>: * Non-maintainer upload by the Security Team. <http://piuparts.knut.univention.de/5.0-2/#2630192578441276999>
OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-2] e49c67455f Bug #55371: libxml2 2.9.4+dfsg1-7+deb10u5 doc/errata/staging/libxml2.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x474>