Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1813-1 Final 1 1 2017-07-07T09:25:11Z current 2017-07-07T09:25:11Z 2017-07-07T09:25:11Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update for libxml2 fixes the following issues: Security issues fixed: * CVE-2017-0663: Fixed a heap buffer overflow in xmlAddID (bsc#1044337) * CVE-2017-5969: Fixed a NULL pointer deref in xmlDumpElementContent (bsc#1024989) * CVE-2017-7375: Prevented an unwanted external entity reference (bsc#1044894) * CVE-2017-7376: Increase buffer space for port in HTTP redirect support (bsc#1044887) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-libxml2-13199,slessp4-libxml2-13199 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/ Link for SUSE-SU-2017:1813-1 https://lists.suse.com/pipermail/sle-security-updates/2017-July/003017.html E-Mail link for SUSE-SU-2017:1813-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1024989 SUSE Bug 1024989 https://bugzilla.suse.com/1044337 SUSE Bug 1044337 https://bugzilla.suse.com/1044887 SUSE Bug 1044887 https://bugzilla.suse.com/1044894 SUSE Bug 1044894 https://www.suse.com/security/cve/CVE-2017-0663/ SUSE CVE CVE-2017-0663 page https://www.suse.com/security/cve/CVE-2017-5969/ SUSE CVE CVE-2017-5969 page https://www.suse.com/security/cve/CVE-2017-7375/ SUSE CVE CVE-2017-7375 page https://www.suse.com/security/cve/CVE-2017-7376/ SUSE CVE CVE-2017-7376 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libxml2-devel-2.7.6-0.76.1 libxml2-devel-32bit-2.7.6-0.76.1 libxml2-2.7.6-0.76.1 libxml2-32bit-2.7.6-0.76.1 libxml2-doc-2.7.6-0.76.1 libxml2-python-2.7.6-0.76.4 libxml2-x86-2.7.6-0.76.1 libxml2-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-32bit-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-doc-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-python-2.7.6-0.76.4 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-x86-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server 11 SP4 libxml2-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-32bit-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-doc-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-python-2.7.6-0.76.4 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-x86-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libxml2-devel-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libxml2-devel-32bit-2.7.6-0.76.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170. CVE-2017-0663 SUSE Linux Enterprise Server 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-32bit-2.7.6-0.76.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/ https://www.suse.com/security/cve/CVE-2017-0663.html CVE-2017-0663 https://bugzilla.suse.com/1044337 SUSE Bug 1044337 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser." CVE-2017-5969 SUSE Linux Enterprise Server 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-32bit-2.7.6-0.76.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/ https://www.suse.com/security/cve/CVE-2017-5969.html CVE-2017-5969 https://bugzilla.suse.com/1024989 SUSE Bug 1024989 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable). CVE-2017-7375 SUSE Linux Enterprise Server 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-32bit-2.7.6-0.76.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/ https://www.suse.com/security/cve/CVE-2017-7375.html CVE-2017-7375 https://bugzilla.suse.com/1044894 SUSE Bug 1044894 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. CVE-2017-7376 SUSE Linux Enterprise Server 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-32bit-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-doc-2.7.6-0.76.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-python-2.7.6-0.76.4 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libxml2-x86-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-2.7.6-0.76.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libxml2-devel-32bit-2.7.6-0.76.1 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171813-1/ https://www.suse.com/security/cve/CVE-2017-7376.html CVE-2017-7376 https://bugzilla.suse.com/1044887 SUSE Bug 1044887 https://bugzilla.suse.com/1123919 SUSE Bug 1123919