Ubuntu Security Notice 1904-1 - It was discovered that libxml2 would load XML external entities by default. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly obtain access to arbitrary files or cause resource consumption. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 12.10. It was discovered that libxml2 incorrectly handled documents that end abruptly. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause libxml2 to crash, resulting in a denial of service. Various other issues were also addressed.
cd859ab9c1529eb842030310fdae2e007f5f2c595e947035ccee976394f0e6e5
============================================================================
Ubuntu Security Notice USN-1904-1
July 15, 2013
libxml2 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in libxml2.
Software Description:
- libxml2: GNOME XML library
Details:
It was discovered that libxml2 would load XML external entities by default.
If a user or automated system were tricked into opening a specially crafted
document, an attacker could possibly obtain access to arbitrary files or
cause resource consumption. This issue only affected Ubuntu 10.04 LTS,
Ubuntu 12.04 LTS, and Ubuntu 12.10. (CVE-2013-0339)
It was discovered that libxml2 incorrectly handled documents that end
abruptly. If a user or automated system were tricked into opening a
specially crafted document, an attacker could possibly cause libxml2 to
crash, resulting in a denial of service. (CVE-2013-2877)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.04:
libxml2 2.9.0+dfsg1-4ubuntu4.2
Ubuntu 12.10:
libxml2 2.8.0+dfsg1-5ubuntu2.3
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.5
Ubuntu 10.04 LTS:
libxml2 2.7.6.dfsg-1ubuntu1.9
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1904-1
CVE-2013-0339, CVE-2013-2877
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.0+dfsg1-4ubuntu4.2
https://launchpad.net/ubuntu/+source/libxml2/2.8.0+dfsg1-5ubuntu2.3
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.5
https://launchpad.net/ubuntu/+source/libxml2/2.7.6.dfsg-1ubuntu1.9