-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1666-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 17, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : libxml2 Vulnerability : several Problem type : local(remote) Debian-specific: no CVE Id(s) : CVE-2008-4225 CVE-2008-4226 Several vulnerabilities have been discovered in the GNOME XML library. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-4225 Drew Yao discovered that missing input sanitising in the xmlBufferResize() function may lead to an infinite loop, resulting in denial of service. CVE-2008-4226 Drew Yao discovered that an integer overflow in the xmlSAX2Characters() function may lead to denial of service or the execution of arbitrary code. For the stable distribution (etch), these problems have been fixed in version 2.6.27.dfsg-6. For the upcoming stable distribution (lenny) and the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your libxml2 packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc Size/MD5 checksum: 893 b6b2006ffadfb999e72974d574814b7c http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz Size/MD5 checksum: 147867 d6a3bbbe39bffe96867de82b11c7c5be Architecture independent packages: http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb Size/MD5 checksum: 1328280 c2990030601040775b909c8ace076100 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb Size/MD5 checksum: 881946 38629543e71a18f6007b8d61d0500e36 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb Size/MD5 checksum: 821150 f14ee677bb7eac20cd65adef90af0f3c http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb Size/MD5 checksum: 37972 d7757b07f8b0c69f9fd0a07a1598a3e3 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb Size/MD5 checksum: 184750 020e5ca7663ee88695e1502c8e8af77c http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb Size/MD5 checksum: 917020 f837c687d428d94559bf68e012bc0e02 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb Size/MD5 checksum: 745790 94edf60cc7d02dd31a70376baf740958 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb Size/MD5 checksum: 892010 a648a6d69a73593739035d78ed3c8436 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb Size/MD5 checksum: 796410 9f38a5028c33f32cf1701535c1c37984 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb Size/MD5 checksum: 36682 4de1bfa28b9361e462075451befbe66c http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb Size/MD5 checksum: 184126 1aae3163d718d0c378203b7ea1a53a9b arm architecture (ARM) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb Size/MD5 checksum: 673236 cda6995615db6e74610d8a51607e85e4 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb Size/MD5 checksum: 817602 c5f81e370d055ba14a40a64d3fbb6e9e http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb Size/MD5 checksum: 34682 4b01403ce80c2949f31559e0eacc044b http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb Size/MD5 checksum: 165284 f84251cc53fa6b67b7fb55f58dd47d5b http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb Size/MD5 checksum: 742176 2e9e6cbbc777d49a99d8a6d98c5dc799 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb Size/MD5 checksum: 858220 0f8cf389ab60a7639fac0f6499325995 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb Size/MD5 checksum: 863998 2332655d5ec188cf038cf9fcab862d9f http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb Size/MD5 checksum: 850370 6c600a26f96c3a3eea898821b0a63937 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb Size/MD5 checksum: 36852 75d6a8790e01eacb3183e6f295542215 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb Size/MD5 checksum: 192850 f635c62c33d9a2ea17015b08370dfd8f i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb Size/MD5 checksum: 857246 6cebb1b5f8e5e87c00319eb59df9c497 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb Size/MD5 checksum: 169026 31acf12efa0a8f37045f3f0869b894f8 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb Size/MD5 checksum: 681544 f0f383f2ea6ae309bfbcd13f2a2e8efa http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb Size/MD5 checksum: 756128 f776e4a0c28389602bb6b26965fc70ce http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb Size/MD5 checksum: 34496 0cf1427860bb36162af23351285ff091 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb Size/MD5 checksum: 196528 3eaa55301a20961852f3a3c5b64bde8c http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb Size/MD5 checksum: 48494 280c616ff34b4aa41a48173828b6e66c http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb Size/MD5 checksum: 1106616 e7b32b8f711337ca52a041af581a05b6 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb Size/MD5 checksum: 1080448 a7334ed64dba73272b2001e09d18493f http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb Size/MD5 checksum: 874194 1410e29414572197b6f82dd5a8be061f mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb Size/MD5 checksum: 840690 ad2ce083ff5c14656ea3ae28b0fa783d http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb Size/MD5 checksum: 770540 d1faeaa723c3de301fb4c8a44ece376a http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb Size/MD5 checksum: 34424 c7c9469462957365ab26e7f06e1f0521 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb Size/MD5 checksum: 171674 5e6f7cbe84d053bd19dda54346330f75 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb Size/MD5 checksum: 926930 c4a3402711ebb05f38b1146eebcd0a71 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb Size/MD5 checksum: 34396 79f5ff849d9a0ed01ab567ec542b7f3e http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb Size/MD5 checksum: 898480 c195cceafe5efce1de168475a462be54 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb Size/MD5 checksum: 769244 d0d36bff7e63adf76857166c3ed10daa http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb Size/MD5 checksum: 168696 3667deae6585a788c4da731b4fc9383d http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb Size/MD5 checksum: 833258 4b1612f79d4b9d1ce2d7086fbb8edbd0 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb Size/MD5 checksum: 780124 0d2ed3ecc5a1e7a5ce3870fab1bcfc43 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb Size/MD5 checksum: 172736 2011f174234c5e939cebeedc2fd9e707 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb Size/MD5 checksum: 37662 94991d67033b1b921bb72e5d7bf2b844 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb Size/MD5 checksum: 898080 321d90790cf68bc046b9b577e7986438 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb Size/MD5 checksum: 771124 47b6d53839ea42f54ae6ad2b89594a26 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb Size/MD5 checksum: 36368 fbc5505f4471c4c2fe6ad41903c5596f http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb Size/MD5 checksum: 885484 ead63bcf342e568c9c338c2772ea4e0d http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb Size/MD5 checksum: 750248 ed7465c981212e90fac94dc040ac6bb4 http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb Size/MD5 checksum: 185718 414512cb0af24a7c5e3622b75ef9b56f http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb Size/MD5 checksum: 806342 0f85b6120fdba835eaf39d02b4a606d9 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb Size/MD5 checksum: 34578 dd02c5498d378ee75330f8f93b2eb3a7 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb Size/MD5 checksum: 781490 ecf288ea66fc19e8f9874b90884a888e http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb Size/MD5 checksum: 713214 434a8a91f3a4acbfc3df2a2707acbbe0 http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb Size/MD5 checksum: 759786 83ba89269fd32296c48c8498e100372b http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb Size/MD5 checksum: 176878 9840698d19580fe86bfc55a2347361e5 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkkh/toACgkQXm3vHE4uylrA7QCeOrg7IGAYqMSs1zh4r83vykT8 /wcAn15KByQrhQVyIVmYM92GvpOn0NJg =0ZjW -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/