Описание
Security update for libxml2
Список пакетов
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Desktop 11 SP4
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP3-TERADATA
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP3
SUSE Linux Enterprise Server for SAP Applications 11 SP4
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Software Development Kit 11 SP4
Ссылки
- Link for SUSE-SU-2016:0030-1
- E-Mail link for SUSE-SU-2016:0030-1
- SUSE Security Ratings
- SUSE Bug 928193
- SUSE Bug 951734
- SUSE Bug 951735
- SUSE Bug 956018
- SUSE Bug 956021
- SUSE Bug 956260
- SUSE Bug 957105
- SUSE Bug 957106
- SUSE Bug 957107
- SUSE Bug 957109
- SUSE Bug 957110
- SUSE CVE CVE-2015-1819 page
- SUSE CVE CVE-2015-5312 page
- SUSE CVE CVE-2015-7497 page
- SUSE CVE CVE-2015-7498 page
- SUSE CVE CVE-2015-7499 page
- SUSE CVE CVE-2015-7500 page
Описание
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Затронутые продукты
Ссылки
- CVE-2015-1819
- SUSE Bug 1123919
- SUSE Bug 928193
- SUSE Bug 969769
Описание
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Затронутые продукты
Ссылки
- CVE-2015-5312
- SUSE Bug 1123919
- SUSE Bug 957105
- SUSE Bug 959469
- SUSE Bug 969769
Описание
Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors.
Затронутые продукты
Ссылки
- CVE-2015-7497
- SUSE Bug 1123919
- SUSE Bug 957106
- SUSE Bug 959469
- SUSE Bug 969769
Описание
Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure.
Затронутые продукты
Ссылки
- CVE-2015-7498
- SUSE Bug 1123919
- SUSE Bug 957107
- SUSE Bug 959469
- SUSE Bug 969769
Описание
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Затронутые продукты
Ссылки
- CVE-2015-7499
- SUSE Bug 1123919
- SUSE Bug 957109
- SUSE Bug 959469
- SUSE Bug 969769
Описание
The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags.
Затронутые продукты
Ссылки
- CVE-2015-7500
- SUSE Bug 1123919
- SUSE Bug 957110
- SUSE Bug 959469
- SUSE Bug 969769
Описание
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Затронутые продукты
Ссылки
- CVE-2015-7941
- SUSE Bug 1123919
- SUSE Bug 951734
- SUSE Bug 951735
- SUSE Bug 969769
Описание
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
Затронутые продукты
Ссылки
- CVE-2015-7942
- SUSE Bug 1123919
- SUSE Bug 951735
- SUSE Bug 969769
Описание
The xmlNextChar function in libxml2 2.9.2 does not properly check the state, which allows context-dependent attackers to cause a denial of service (heap-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Затронутые продукты
Ссылки
- CVE-2015-8241
- SUSE Bug 1123919
- SUSE Bug 956018
- SUSE Bug 959469
- SUSE Bug 969769
Описание
The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data.
Затронутые продукты
Ссылки
- CVE-2015-8242
- SUSE Bug 1123919
- SUSE Bug 956021
- SUSE Bug 959469
- SUSE Bug 969769
Описание
The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Затронутые продукты
Ссылки
- CVE-2015-8317
- SUSE Bug 1123919
- SUSE Bug 956260
- SUSE Bug 959469
- SUSE Bug 969769