Описание
Security update for expat
This update for expat fixes the following security issues:
- CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, made it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. (bsc#983215)
- CVE-2016-5300: The XML parser in Expat did not use sufficient entropy for hash initialization, which allowed context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. (bsc#983216)
Список пакетов
SUSE Linux Enterprise Desktop 12 SP1
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP2
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Server 12 SP1
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Server 12 SP2
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
SUSE Linux Enterprise Server for SAP Applications 12 SP1
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Server for SAP Applications 12 SP2
expat-2.1.0-20.2
libexpat1-2.1.0-20.2
libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Software Development Kit 12 SP1
libexpat-devel-2.1.0-20.2
SUSE Linux Enterprise Software Development Kit 12 SP2
libexpat-devel-2.1.0-20.2
Ссылки
- Link for SUSE-SU-2017:0424-1
- E-Mail link for SUSE-SU-2017:0424-1
- SUSE Security Ratings
- SUSE Bug 983215
- SUSE Bug 983216
- SUSE CVE CVE-2012-6702 page
- SUSE CVE CVE-2016-5300 page
Описание
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:expat-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP1:libexpat1-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP1:libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP2:expat-2.1.0-20.2
Ссылки
- CVE-2012-6702
- SUSE Bug 983215
- SUSE Bug 983216
Описание
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:expat-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP1:libexpat1-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP1:libexpat1-32bit-2.1.0-20.2
SUSE Linux Enterprise Desktop 12 SP2:expat-2.1.0-20.2
Ссылки
- CVE-2016-5300
- SUSE Bug 983216