Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1670-1 Final 1 1 2017-06-26T06:12:37Z current 2017-06-26T06:12:37Z 2017-06-26T06:12:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: Security issues fixed: * CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID (bsc#1044337) * CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent (bsc#1024989) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2017-1036,SUSE-SLE-DESKTOP-12-SP2-2017-1036,SUSE-SLE-RPI-12-SP2-2017-1036,SUSE-SLE-SDK-12-SP2-2017-1036,SUSE-SLE-SERVER-12-SP2-2017-1036 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171670-1/ Link for SUSE-SU-2017:1670-1 https://lists.suse.com/pipermail/sle-security-updates/2017-June/002977.html E-Mail link for SUSE-SU-2017:1670-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1024989 SUSE Bug 1024989 https://bugzilla.suse.com/1044337 SUSE Bug 1044337 https://www.suse.com/security/cve/CVE-2017-0663/ SUSE CVE CVE-2017-0663 page https://www.suse.com/security/cve/CVE-2017-5969/ SUSE CVE CVE-2017-5969 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 libxml2-2-2.9.4-42.1 libxml2-2-32bit-2.9.4-42.1 libxml2-tools-2.9.4-42.1 python-libxml2-2.9.4-42.1 libxml2-doc-2.9.4-42.1 libxml2-devel-2.9.4-42.1 libxml2-2-2.9.4-42.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libxml2-2-32bit-2.9.4-42.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libxml2-tools-2.9.4-42.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 python-libxml2-2.9.4-42.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libxml2-2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server 12 SP2 libxml2-2-32bit-2.9.4-42.1 as a component of SUSE Linux Enterprise Server 12 SP2 libxml2-doc-2.9.4-42.1 as a component of SUSE Linux Enterprise Server 12 SP2 libxml2-tools-2.9.4-42.1 as a component of SUSE Linux Enterprise Server 12 SP2 python-libxml2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server 12 SP2 libxml2-2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libxml2-doc-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libxml2-tools-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 python-libxml2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libxml2-2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libxml2-2-32bit-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libxml2-doc-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libxml2-tools-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 python-libxml2-2.9.4-42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libxml2-devel-2.9.4-42.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. CVE-2017-0663 SUSE Linux Enterprise Desktop 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libxml2-devel-2.9.4-42.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171670-1/ https://www.suse.com/security/cve/CVE-2017-0663.html CVE-2017-0663 https://bugzilla.suse.com/1044337 SUSE Bug 1044337 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser." CVE-2017-5969 SUSE Linux Enterprise Desktop 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Desktop 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-2-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-2-32bit-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-doc-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libxml2-tools-2.9.4-42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:python-libxml2-2.9.4-42.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libxml2-devel-2.9.4-42.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171670-1/ https://www.suse.com/security/cve/CVE-2017-5969.html CVE-2017-5969 https://bugzilla.suse.com/1024989 SUSE Bug 1024989 https://bugzilla.suse.com/1123919 SUSE Bug 1123919