Jesse Keating
21/07/04, 09:45
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated libxml2 resolves security vulnerability
Advisory ID: FLSA:1324
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1324
CVE Names: CAN-2004-0110
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated libxml2 packages that fix an overflow when parsing remote resources=
=20
are now available.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
3. Problem description:
libxml2 is a library for manipulating XML files.
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. =20
When fetching a remote resource via FTP or HTTP, libxml2 uses special=20
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that=
=20
parses remote resources and allows them to influence the URL, then this=20
flaw could be used to execute arbitrary code. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0110=20
to this issue.
All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.
=46edora Legacy would like to thank Johnny Strom for reporting this issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1324 - libxml2: an overflow when parsing remote=
=20
resources.
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/libxml2-2.4.19-5.=
legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-2.4.19-5.l=
egacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-python-2.4=
=2E19-5.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-devel-2.4.=
19-5.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
7ea6c8e40a04c2eafb82d53e8e6931b27348f4ad =20
7.3/updates/SRPMS/libxml2-2.4.19-5.legacy.src.rpm
c325b2b9d03335b41db6b0b462a35d1ed847e56f =20
7.3/updates/i386/libxml2-2.4.19-5.legacy.i386.rpm
c53f70cad435630b3e5b5f5d363c7d425f980a35 =20
7.3/updates/i386/libxml2-devel-2.4.19-5.legacy.i386.rpm
8819fa789731693645839f32f55aac2f2dc27906 =20
7.3/updates/i386/libxml2-python-2.4.19-5.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0110
https://www.redhat.com/archives/redhat-watch-list/2004-February/msg00007.ht=
ml
http://mail.gnome.org/archives/xml/2004-February/msg00070.html
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)
Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA/JVx4v2HLvE71NURAk+sAKCtr5UVXfrGLhkoHxfi5BHyDLtBmQC gum0l
5hirw0+x3WPmJhPz+nqydX4=3D
=3DXs3j
=2D----END PGP SIGNATURE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated libxml2 resolves security vulnerability
Advisory ID: FLSA:1324
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1324
CVE Names: CAN-2004-0110
=2D -----------------------------------------------------------------------
=2D ---------------------------------------------------------------------
1. Topic:
Updated libxml2 packages that fix an overflow when parsing remote resources=
=20
are now available.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
3. Problem description:
libxml2 is a library for manipulating XML files.
Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. =20
When fetching a remote resource via FTP or HTTP, libxml2 uses special=20
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that=
=20
parses remote resources and allows them to influence the URL, then this=20
flaw could be used to execute arbitrary code. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0110=20
to this issue.
All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.
=46edora Legacy would like to thank Johnny Strom for reporting this issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1324 - libxml2: an overflow when parsing remote=
=20
resources.
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/libxml2-2.4.19-5.=
legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-2.4.19-5.l=
egacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-python-2.4=
=2E19-5.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-devel-2.4.=
19-5.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
7ea6c8e40a04c2eafb82d53e8e6931b27348f4ad =20
7.3/updates/SRPMS/libxml2-2.4.19-5.legacy.src.rpm
c325b2b9d03335b41db6b0b462a35d1ed847e56f =20
7.3/updates/i386/libxml2-2.4.19-5.legacy.i386.rpm
c53f70cad435630b3e5b5f5d363c7d425f980a35 =20
7.3/updates/i386/libxml2-devel-2.4.19-5.legacy.i386.rpm
8819fa789731693645839f32f55aac2f2dc27906 =20
7.3/updates/i386/libxml2-python-2.4.19-5.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2004-0110
https://www.redhat.com/archives/redhat-watch-list/2004-February/msg00007.ht=
ml
http://mail.gnome.org/archives/xml/2004-February/msg00070.html
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D ---------------------------------------------------------------------
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)
Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFA/JVx4v2HLvE71NURAk+sAKCtr5UVXfrGLhkoHxfi5BHyDLtBmQC gum0l
5hirw0+x3WPmJhPz+nqydX4=3D
=3DXs3j
=2D----END PGP SIGNATURE-----