Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0764-1

Опубликовано: 22 мая 2021
Источник: suse-cvrf

Описание

Security update for libxml2

This update for libxml2 fixes the following issues:

  • CVE-2021-3537: NULL pointer dereference in valid.c:xmlValidBuildAContentModel (bsc#1185698)
  • CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408).
  • CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410).
  • CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.2
libxml2-2-2.9.7-lp152.10.12.1
libxml2-2-32bit-2.9.7-lp152.10.12.1
libxml2-devel-2.9.7-lp152.10.12.1
libxml2-devel-32bit-2.9.7-lp152.10.12.1
libxml2-doc-2.9.7-lp152.10.12.1
libxml2-tools-2.9.7-lp152.10.12.1
python2-libxml2-python-2.9.7-lp152.10.12.1
python3-libxml2-python-2.9.7-lp152.10.12.1

Ссылки

Описание

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Затронутые продукты
openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1
Ссылки

Описание

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Затронутые продукты
openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1
Ссылки

Описание

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Затронутые продукты
openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1
Ссылки

Описание

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

Затронутые продукты
openSUSE Leap 15.2:libxml2-2-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-2-32bit-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-2.9.7-lp152.10.12.1
openSUSE Leap 15.2:libxml2-devel-32bit-2.9.7-lp152.10.12.1
Ссылки
Уязвимость openSUSE-SU-2021:0764-1