Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1205-1 Final 1 1 2016-05-03T14:22:21Z current 2016-05-03T14:22:21Z 2016-05-03T14:22:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes two security issues: - libxml2 limits the number of recursions an XML document can contain so to protect against the 'Billion Laughs' denial-of-service attack. Unfortunately, the underlying counter was not incremented properly in all necessary locations. Therefore, specially crafted XML documents could exhaust all available stack space and crash the XML parser without running into the recursion limit. This vulnerability has been fixed. (bsc#975947) - When running in recovery mode, certain invalid XML documents would trigger an infinite recursion in libxml2 that ran until all stack space was exhausted. This vulnerability could have been used to facilitate a denial-of-sevice attack. (CVE-2016-3627, bsc#972335) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-libxml2-12538,slessp4-libxml2-12538 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161205-1/ Link for SUSE-SU-2016:1205-1 https://lists.suse.com/pipermail/sle-security-updates/2016-May/002037.html E-Mail link for SUSE-SU-2016:1205-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/972335 SUSE Bug 972335 https://bugzilla.suse.com/975947 SUSE Bug 975947 https://www.suse.com/security/cve/CVE-2016-3627/ SUSE CVE CVE-2016-3627 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libxml2-devel-2.7.6-0.40.1 libxml2-devel-32bit-2.7.6-0.40.1 libxml2-2.7.6-0.40.1 libxml2-32bit-2.7.6-0.40.1 libxml2-doc-2.7.6-0.40.1 libxml2-python-2.7.6-0.40.3 libxml2-x86-2.7.6-0.40.1 libxml2-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-32bit-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-doc-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-python-2.7.6-0.40.3 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-x86-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-32bit-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-doc-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-python-2.7.6-0.40.3 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-x86-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-devel-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libxml2-devel-32bit-2.7.6-0.40.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. CVE-2016-3627 SUSE Linux Enterprise Server 11 SP4:libxml2-2.7.6-0.40.1 SUSE Linux Enterprise Server 11 SP4:libxml2-32bit-2.7.6-0.40.1 SUSE Linux Enterprise Server 11 SP4:libxml2-doc-2.7.6-0.40.1 SUSE Linux Enterprise Server 11 SP4:libxml2-python-2.7.6-0.40.3 SUSE Linux Enterprise Server 11 SP4:libxml2-x86-2.7.6-0.40.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-2.7.6-0.40.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-32bit-2.7.6-0.40.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-doc-2.7.6-0.40.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-python-2.7.6-0.40.3 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-x86-2.7.6-0.40.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-2.7.6-0.40.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-32bit-2.7.6-0.40.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161205-1/ https://www.suse.com/security/cve/CVE-2016-3627.html CVE-2016-3627 https://bugzilla.suse.com/1026099 SUSE Bug 1026099 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/972335 SUSE Bug 972335 https://bugzilla.suse.com/975947 SUSE Bug 975947