-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:188 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libxml2 Date : December 15, 2011 Affected: 2010.1, 2011., Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in libxml2: Off-by-one error in libxml allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted web site CVE-2011-0216). libxml2 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors (CVE-2011-3905). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0216 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3905 _______________________________________________________________________ Updated Packages: Mandriva Linux 2010.1: 23ef99787f1b7ef3e64bc0762f3f3a4e 2010.1/i586/libxml2_2-2.7.7-1.5mdv2010.2.i586.rpm feb02c6f36c8583a5bc2854f0433fe86 2010.1/i586/libxml2-devel-2.7.7-1.5mdv2010.2.i586.rpm b706e84011c20d382a18a086894dca2b 2010.1/i586/libxml2-python-2.7.7-1.5mdv2010.2.i586.rpm b963f6ab4f39336a51a0471de5c0a9da 2010.1/i586/libxml2-utils-2.7.7-1.5mdv2010.2.i586.rpm dc474dd86bf91fbb13fcd8968a27194f 2010.1/SRPMS/libxml2-2.7.7-1.5mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: a61db16fd54c0fda75a5c0268d3524bd 2010.1/x86_64/lib64xml2_2-2.7.7-1.5mdv2010.2.x86_64.rpm 4f2fd97b4bbab696fae212559295516f 2010.1/x86_64/lib64xml2-devel-2.7.7-1.5mdv2010.2.x86_64.rpm 8064e2b0a5d5525c533be6cd61f20293 2010.1/x86_64/libxml2-python-2.7.7-1.5mdv2010.2.x86_64.rpm d1aab22793a453e2fbaa6bc2c05b0de0 2010.1/x86_64/libxml2-utils-2.7.7-1.5mdv2010.2.x86_64.rpm dc474dd86bf91fbb13fcd8968a27194f 2010.1/SRPMS/libxml2-2.7.7-1.5mdv2010.2.src.rpm Mandriva Linux 2011: 8d0ea419886a45a7d2106d1f697fb0af 2011/i586/libxml2_2-2.7.8-6.3-mdv2011.0.i586.rpm bbd914f659c2ea83a438eddcd3c31292 2011/i586/libxml2-devel-2.7.8-6.3-mdv2011.0.i586.rpm 9cc5144f6394ef736686b81087aea4a3 2011/i586/libxml2-python-2.7.8-6.3-mdv2011.0.i586.rpm 221cd5a0cef6bd5a651469811977dd1a 2011/i586/libxml2-utils-2.7.8-6.3-mdv2011.0.i586.rpm f2683b77635f1ee49afff8cb8ad2e470 2011/SRPMS/libxml2-2.7.8-6.3.src.rpm Mandriva Linux 2011/X86_64: 7a2de229452cbb4478f81a2a0c8f95f7 2011/x86_64/lib64xml2_2-2.7.8-6.3-mdv2011.0.x86_64.rpm f7de6d69fe1b4da9cddafce53db848e5 2011/x86_64/lib64xml2-devel-2.7.8-6.3-mdv2011.0.x86_64.rpm d90a089bcbcff95fd5db9b5a41eb0344 2011/x86_64/libxml2-python-2.7.8-6.3-mdv2011.0.x86_64.rpm 65b6d64de1c97b977d9b0264e9520623 2011/x86_64/libxml2-utils-2.7.8-6.3-mdv2011.0.x86_64.rpm f2683b77635f1ee49afff8cb8ad2e470 2011/SRPMS/libxml2-2.7.8-6.3.src.rpm Mandriva Enterprise Server 5: d0c8c07632d01258639be4b038ab75d4 mes5/i586/libxml2_2-2.7.1-1.9mdvmes5.2.i586.rpm d8e7605a3fb748bc7c5c0f577ffbe7b4 mes5/i586/libxml2-devel-2.7.1-1.9mdvmes5.2.i586.rpm 677c93e393fe0004d1a2e543e498555d mes5/i586/libxml2-python-2.7.1-1.9mdvmes5.2.i586.rpm d9b1ba626d9514b26a3bf86719dfc62f mes5/i586/libxml2-utils-2.7.1-1.9mdvmes5.2.i586.rpm c307b638da506db8346e1f790f39d772 mes5/SRPMS/libxml2-2.7.1-1.9mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: d8062c5526c39d22f819f2f70d104d2d mes5/x86_64/lib64xml2_2-2.7.1-1.9mdvmes5.2.x86_64.rpm 12eabde65491a7f6883247a27b239a97 mes5/x86_64/lib64xml2-devel-2.7.1-1.9mdvmes5.2.x86_64.rpm 728ad366c8f67640a50b6bb6f7260684 mes5/x86_64/libxml2-python-2.7.1-1.9mdvmes5.2.x86_64.rpm f91719adff8bc425c66930f5d0aa81a3 mes5/x86_64/libxml2-utils-2.7.1-1.9mdvmes5.2.x86_64.rpm c307b638da506db8346e1f790f39d772 mes5/SRPMS/libxml2-2.7.1-1.9mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFO6hv4mqjQ0CJFipgRAuEiAJ9pawfaABlHvmfJ09uDgpCeLNpgewCg5JCF 0fNH1rrHGgpcLTBb8rTOo8Y= =ulBu -----END PGP SIGNATURE-----