==========================================================================
Ubuntu Security Notice USN-2994-1
June 06, 2016
libxml2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 16.04 LTS
– Ubuntu 15.10
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in libxml2.
Software Description:
– libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2015-8806, CVE-2016-2073,
CVE-2016-3627, CVE-2016-3705, CVE-2016-4447)
It was discovered that libxml2 incorrectly handled certain malformed
documents. If a user or automated system were tricked into opening a
specially crafted document, an attacker could cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-1762, CVE-2016-1834)
Mateusz Jurczyk discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1833, CVE-2016-1838, CVE-2016-1839)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1835, CVE-2016-1837)
Wei Lei and Liu Yang discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and
Ubuntu 16.04 LTS. (CVE-2016-1836)
Kostya Serebryany discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could cause libxml2 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1840)
It was discovered that libxml2 would load certain XML external entities. If
a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. (CVE-2016-4449)
Gustavo Grieco discovered that libxml2 incorrectly handled certain
malformed documents. If a user or automated system were tricked into
opening a specially crafted document, an attacker could possibly cause
libxml2 to crash, resulting in a denial of service. (CVE-2016-4483)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.1
Ubuntu 15.10:
libxml2 2.9.2+zdfsg1-4ubuntu0.4
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.8
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.15
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2994-1
CVE-2015-8806, CVE-2016-1762, CVE-2016-1833, CVE-2016-1834,
CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838,
CVE-2016-1839, CVE-2016-1840, CVE-2016-2073, CVE-2016-3627,
CVE-2016-3705, CVE-2016-4447, CVE-2016-4449, CVE-2016-4483
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.2+zdfsg1-4ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.8
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.15
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAEBCgAGBQJXVbfmAAoJEGVp2FWnRL6TMGAP/1Ouz3CwxCVKrxAETopcvzT5
4ozan1DJorPwr3p1KKhWLUWK5oack2PtvIeLQ4Pf0Cj4hhfwO0gobF+crbyRR6mQ
TjgHXUc96s7kIpZn5O9E+VeIo6a2iK2UQYDMQm7SGDKJX8mmb7gzxrb9m+Z7If/Z
WS2QU6fEXByPEUMgQG2bgY33Ppniltxxi640WK4qvLlWOLBNUT9Y5sDzzSHNA5Tb
rGKfZVV2vHYOFG0oyCx24hL7aca/Tak7+iIQS/9xBpodr+bCHJphjXRJXN9oyca7
lLvW2X18t/bnVef8lPTXOcowH1zliVBXuuVCUBUdht3nZsQEmtykQ1GIFuJCJm4/
wymYYZ/zHy5memTp+uTf8keKmhz0s5UV421pK4zkAo2wXX2NW6uczUa4b6s68+Dw
rEHDbbQeVbxBlMr9RS54J3mWdLyV9J4tijPU4e4MmSi8udkBWBBc6y+4vnAB7kSo
r/cgQd1ULuJLiEv/L4nrzMqa3O7taQNwSHlvY5xHYWWPCuph/DVsjXPTavmIMaiF
InLZFV86FHFkyEYEknW1vxpt9dJfU+TswzBuQLDi+KqbO/OAzAARmY6ajU2FJNR7
s14D7tNIvPIjFkuUX50sSfLBoRCaxolRr3G5kBNJ51SH7/TKOLgVOwS2Pw3CTp+Y
NOwPPV2xjxb6LwStUgh1
=OT5F
—–END PGP SIGNATURE—–
—
