1. Ubuntu Security Notices
  2. USN-1334-1

USN-1334-1: libxml2 vulnerabilities

Publication date

19 January 2012

Overview

Applications using libxml2 could be made to crash or run programs as your login if they opened a specially crafted file.

Releases

Packages

Details

It was discovered that libxml2 contained an off by one error. If a user or
application linked against libxml2 were tricked into opening a specially
crafted XML file, an attacker could cause the application to crash or
possibly execute arbitrary code with the privileges of the user invoking
the program. (CVE-2011-0216)

It was discovered that libxml2 is vulnerable to double-free conditions
when parsing certain XML documents. This could allow a remote attacker to
cause a denial of service. (CVE-2011-2821, CVE-2011-2834)

It was discovered that libxml2 did not properly detect end of file when
parsing certain XML documents. An attacker could exploit this to crash
applications linked against libxml2. (CVE-2011-3905)

It was discovered that libxml2 did not properly decode entity...

It was discovered that libxml2 contained an off by one error. If a user or
application linked against libxml2 were tricked into opening a specially
crafted XML file, an attacker could cause the application to crash or
possibly execute arbitrary code with the privileges of the user invoking
the program. (CVE-2011-0216)

It was discovered that libxml2 is vulnerable to double-free conditions
when parsing certain XML documents. This could allow a remote attacker to
cause a denial of service. (CVE-2011-2821, CVE-2011-2834)

It was discovered that libxml2 did not properly detect end of file when
parsing certain XML documents. An attacker could exploit this to crash
applications linked against libxml2. (CVE-2011-3905)

It was discovered that libxml2 did not properly decode entity references
with long names. If a user or application linked against libxml2 were
tricked into opening a specially crafted XML file, an attacker could cause
the application to crash or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2011-3919)

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
8.04 hardy libxml2 –  2.6.31.dfsg-2ubuntu1.7
11.10 oneiric libxml2 –  2.7.8.dfsg-4ubuntu0.1
11.04 natty libxml2 –  2.7.8.dfsg-2ubuntu0.2
10.10 maverick libxml2 –  2.7.7.dfsg-4ubuntu0.3
10.04 lucid libxml2 –  2.7.6.dfsg-1ubuntu1.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›