==========================================================================
Ubuntu Security Notice USN-3513-1
December 13, 2017
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 17.10
– Ubuntu 17.04
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
libxml2 could be made to crash or run arbitrary code if it
opened a specially crafted file.
Software Description:
– libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrecty handled certain files. An
attacker could use this issue with specially constructed XML data to
cause libxml2 to consume resources, leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
libxml2 2.9.4+dfsg1-4ubuntu1.2
libxml2-utils 2.9.4+dfsg1-4ubuntu1.2
python-libxml2 2.9.4+dfsg1-4ubuntu1.2
python3-libxml2 2.9.4+dfsg1-4ubuntu1.2
Ubuntu 17.04:
libxml2 2.9.4+dfsg1-2.2ubuntu0.3
libxml2-utils 2.9.4+dfsg1-2.2ubuntu0.3
python-libxml2 2.9.4+dfsg1-2.2ubuntu0.3
python3-libxml2 2.9.4+dfsg1-2.2ubuntu0.3
Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.5
libxml2-utils 2.9.3+dfsg1-1ubuntu0.5
python-libxml2 2.9.3+dfsg1-1ubuntu0.5
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.12
libxml2-utils 2.9.1+dfsg1-3ubuntu4.12
python-libxml2 2.9.1+dfsg1-3ubuntu4.12
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3513-1
CVE-2017-15412
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-4ubuntu1.2
https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-2.2ubuntu0.3
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.5
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.12
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJaMTTcAAoJEEW851uECx9pUqIP/31wfQyKEB5gQJQlGysI509k
DnCuzwMGFjVNSk8RqwpDn+5VnJylFRSOGNBBi8jv+aU6xev84YNUsHpzduFQd+VH
o2DWEMzsDKfRVXPHGyLNIcEQyHANh+Uc1ZhANFw53TijrRsAo1Wfd6q5jpQsYtU9
n1VWAwZ+BmRZDM+o1daCnMKUeBBNTqQH6+QkJEz8VeCx3YdulB2W77P8D1u2/BKl
9BrI9E/qoJRn5VycL+hSzOvSPpXGezSbkF5e0nhIst9qqFmgNxHsN5b7m3R5UxUQ
HqyxI8GK+JYCAlYt1Wmbn1Qy+L6U5P1XvfSdmXK+V7NfgJAl0gxb9WE5eEAY+VsW
USdDQT8qM1QduV6dgio6V2CnADhnOpYeCzrE6RUPHzkaS8s3R9L710RDyq/Suz+t
2HTFM8ErSs6mFbcg+RUH2dRwPXUQgZJCW9rqra7VZXpx4j766PC0XMHmEhiq98gX
SXqhjqOAPfpPe3yapEHVa5i4SiDlKMmMwcZjKbN0FY4kk8S8N3xdvgjtHgzR9lwC
YWEbLhZSCXAZ2K+5oCvUqp0h5RBuRlyDht0gMG4Bmfm7k7jF/pHAflTRjHXVGbvI
2EdYWBqsKF7MVk2w1dvuPGhq4wk9mdn5KymeAxVmD0Wnw2hfk8gZ8YUqcp4JF8zR
soh6lG/XEC0BSqC9HKiT
=0GRT
—–END PGP SIGNATURE—–
—
==========================================================================
Ubuntu Security Notice USN-3513-2
December 13, 2017
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 12.04 ESM
Summary:
libxml2 could be made to crash or run arbitrary code if it
opened a specially crafted file.
Software Description:
– libxml2: GNOME XML library
Details:
USN-3513-1 fixed a vulnerability in libxml2. This update provides
the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that libxml2 incorrecty handled certain files. An
attacker could use this issue with specially constructed XML data to
cause libxml2 to consume resources, leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libxml2 2.7.8.dfsg-5.1ubuntu4.20
libxml2-utils 2.7.8.dfsg-5.1ubuntu4.20
python-libxml2 2.7.8.dfsg-5.1ubuntu4.20
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3513-2
https://www.ubuntu.com/usn/usn-3513-1
CVE-2017-15412
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJaMUAwAAoJEEW851uECx9psGcQAKHxHDSJL9AUXazoFlidV+BY
P0PP1J7hPvpmufNH29MikJOEBZJ/oVjv43tHcOcsaylLahpbRtPSebtsWKw+EIwY
42mNwLY0a8sn8HkKuxajFW0bC6Yqv4NiJdNRytQ11uJWbXJc6uf8zdQgi0kRnuhR
QAU+63F9yhs16M4ZCzWrvXQzkOUK54wdrFXCrnGKsRS+PO3dmwEryQLoZLbY4y1I
CGYxD/4zQ5FRb3Tqyi7pfus+s2K56n14s1ODNBoTmLckL/07dmlSAh+kvkpSAMjU
KBw+X+XW+UKGRt2GiwZegH4RKfoMYng1diYXKjStVpoP0J9wqfPjA8FwLXlV0HoI
FfSeIxWD0p4TjM0nO7RZBGwZC/3p8GlgWghZoqFDk6bq8oMq26iZ7QpM3EYy2hAy
jgDC8fa/IQXzFHE/NdtE7Z1gMsNDLcayZpHGdS2x7K+TMW0jQ+zph1M+M9P910gG
/GNJrXpODdevWQ8hM7VDIxDM0U62vGx2zO+KwGmoKWBowD0P7d2bvEgbCcAR1xq8
y7Qi5CwLtIe+i6dfA3GnO/VXwdsIYLm6OAP194EPt5AEI3N46pFIS00lIZLv+QQ2
KcfDp+9OXXvq6x28bGQFQDNz8QkosxvT1AowB1t3aPysowvyYK+VL2GrQXbLvBsB
FjYH9xs01VnGVu3gRLdv
=Kk5B
—–END PGP SIGNATURE—–
–
