Security update for libxml2
SUSE Patch
security@suse.de
SUSE Security Team
openSUSE-SU-2016:1595-1
Final
1
1
2016-06-16T08:01:31Z
current
2016-06-16T08:01:31Z
2016-06-16T08:01:31Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for libxml2
This update for libxml2 fixes the following security issues:
- CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread
was fixed in libxml2/dict.c [bsc#963963, bsc#965283, bsc#981114].
- CVE-2016-4483: Code was added to avoid an out of bound access when
serializing malformed strings [bsc#978395].
- CVE-2016-1762: Fixed a heap-based buffer overread in xmlNextChar [bsc#981040].
- CVE-2016-1834: Fixed a heap-buffer-overflow in xmlStrncat [bsc#981041].
- CVE-2016-1833: Fixed a heap-based buffer overread in htmlCurrentChar [bsc#981108].
- CVE-2016-1835: Fixed a heap use-after-free in xmlSAX2AttributeNs [bsc#981109].
- CVE-2016-1837: Fixed a heap use-after-free in htmlParsePubidLiteral
and htmlParseSystemiteral [bsc#981111].
- CVE-2016-1838: Fixed a heap-based buffer overread in
xmlParserPrintFileContextInternal [bsc#981112].
- CVE-2016-1840: Fixed a heap-buffer-overflow in xmlFAParsePosCharGroup [bsc#981115].
- CVE-2016-4447: Fixed a heap-based buffer-underreads due to xmlParseName [bsc#981548].
- CVE-2016-4448: Fixed some format string warnings with possible format
string vulnerability [bsc#981549],
- CVE-2016-4449: Fixed inappropriate fetch of entities content [bsc#981550].
- CVE-2016-3705: Fixed missing increment of recursion counter.
This update was imported from the SUSE:SLE-12:Update update project.
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
E-Mail link for openSUSE-SU-2016:1595-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
openSUSE Leap 42.1
libxml2-2.9.1-19.1
libxml2-2-2.9.1-19.1
libxml2-2-32bit-2.9.1-19.1
libxml2-devel-2.9.1-19.1
libxml2-devel-32bit-2.9.1-19.1
libxml2-doc-2.9.1-19.1
libxml2-tools-2.9.1-19.1
python-libxml2-2.9.1-19.1
libxml2-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-2-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-2-32bit-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-devel-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-devel-32bit-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-doc-2.9.1-19.1 as a component of openSUSE Leap 42.1
libxml2-tools-2.9.1-19.1 as a component of openSUSE Leap 42.1
python-libxml2-2.9.1-19.1 as a component of openSUSE Leap 42.1
dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
CVE-2015-8806
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
4.3
AV:N/AC:M/Au:N/C:P/I:N/A:N
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2015-8806.html
CVE-2015-8806
https://bugzilla.suse.com/963963
SUSE Bug 963963
https://bugzilla.suse.com/965283
SUSE Bug 965283
https://bugzilla.suse.com/981114
SUSE Bug 981114
The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
CVE-2016-1762
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1762.html
CVE-2016-1762
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981040
SUSE Bug 981040
The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
CVE-2016-1833
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1833.html
CVE-2016-1833
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981108
SUSE Bug 981108
Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
CVE-2016-1834
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1834.html
CVE-2016-1834
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981041
SUSE Bug 981041
Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.
CVE-2016-1835
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1835.html
CVE-2016-1835
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981109
SUSE Bug 981109
Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.
CVE-2016-1837
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1837.html
CVE-2016-1837
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981111
SUSE Bug 981111
The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
CVE-2016-1838
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1838.html
CVE-2016-1838
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981112
SUSE Bug 981112
The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
CVE-2016-1839
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1839.html
CVE-2016-1839
https://bugzilla.suse.com/1039069
SUSE Bug 1039069
https://bugzilla.suse.com/1039661
SUSE Bug 1039661
https://bugzilla.suse.com/1069433
SUSE Bug 1069433
https://bugzilla.suse.com/1069690
SUSE Bug 1069690
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/963963
SUSE Bug 963963
https://bugzilla.suse.com/981114
SUSE Bug 981114
Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
CVE-2016-1840
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-1840.html
CVE-2016-1840
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981115
SUSE Bug 981115
The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.
CVE-2016-2073
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-2073.html
CVE-2016-2073
https://bugzilla.suse.com/963963
SUSE Bug 963963
The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.
CVE-2016-3705
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-3705.html
CVE-2016-3705
https://bugzilla.suse.com/1017497
SUSE Bug 1017497
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/975947
SUSE Bug 975947
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
CVE-2016-4447
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-4447.html
CVE-2016-4447
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981548
SUSE Bug 981548
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVE-2016-4448
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-4448.html
CVE-2016-4448
https://bugzilla.suse.com/1010299
SUSE Bug 1010299
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981549
SUSE Bug 981549
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
CVE-2016-4449
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
moderate
4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-4449.html
CVE-2016-4449
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/981550
SUSE Bug 981550
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
CVE-2016-4483
openSUSE Leap 42.1:libxml2-2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-2.9.1-19.1
openSUSE Leap 42.1:libxml2-devel-32bit-2.9.1-19.1
openSUSE Leap 42.1:libxml2-doc-2.9.1-19.1
openSUSE Leap 42.1:libxml2-tools-2.9.1-19.1
openSUSE Leap 42.1:python-libxml2-2.9.1-19.1
low
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
Please Install the update.
https://lists.opensuse.org/opensuse-security-announce/2016-06/msg00026.html
https://www.suse.com/security/cve/CVE-2016-4483.html
CVE-2016-4483
https://bugzilla.suse.com/1026101
SUSE Bug 1026101
https://bugzilla.suse.com/1123919
SUSE Bug 1123919
https://bugzilla.suse.com/978395
SUSE Bug 978395