USN-644-1: libxml2 vulnerabilities

Releases

• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 7.04
• Ubuntu 6.06

Packages

• libxml2 -

Details

It was discovered that libxml2 did not correctly handle long entity names.
If a user were tricked into processing a specially crafted XML document,
a remote attacker could execute arbitrary code with user privileges
or cause the application linked against libxml2 to crash, leading to a
denial of service. (CVE-2008-3529)

USN-640-1 fixed vulnerabilities in libxml2. When processing extremely
large XML documents with valid entities, it was possible to incorrectly
trigger the newly added vulnerability protections. This update fixes
the problem. (CVE-2008-3281)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.04

• libxml2 - 2.6.31.dfsg-2ubuntu1.2

Ubuntu 7.10

• libxml2 - 2.6.30.dfsg-2ubuntu1.3

Ubuntu 7.04

• libxml2 - 2.6.27.dfsg-1ubuntu3.3

Ubuntu 6.06

• libxml2 - 2.6.24.dfsg-1ubuntu1.3

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-3281
• CVE-2008-3529

Related notices

• USN-640-1: libxml2
• USN-815-1: libxml2