Advisories » MGASA-2015-0358

Updated libxml2 packages fix security vulnerabilities

Publication date: 08 Sep 2015
Modification date: 08 Sep 2015
Type: security
Affected Mageia releases : 4 , 5
CVE: CVE-2015-1819

Description

Updated libxml2 packages fix security vulnerability:

The xmlreader in libxml2 allows remote attackers to cause a denial of service
(memory consumption) via crafted XML data, related to an XML Entity Expansion
(XEE) attack (CVE-2015-1819).

The libxml2 package has been patched to fix this issue, as well as two
out-of-bounds read issues (bgo#744980, bgo#746048).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16286
• https://bugzilla.gnome.org/show_bug.cgi?id=744980
• https://bugzilla.gnome.org/show_bug.cgi?id=746048
• http://lwn.net/Alerts/650108/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819

SRPMS

4/core

• libxml2-2.9.1-2.3.mga4

5/core

• libxml2-2.9.1-11.1.mga5