=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory

Synopsis: Updated libxml2 resolves security vulnerability
Advisory ID: FLSA:1324
Issue date: 2004-07-19
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1324
CVE Names: CAN-2004-0110
=2D -----------------------------------------------------------------------


=2D ---------------------------------------------------------------------
1. Topic:

Updated libxml2 packages that fix an overflow when parsing remote resources=
=20
are now available.

2. Relevent releases/architectures:

Red Hat Linux 7.3 - i386

3. Problem description:

libxml2 is a library for manipulating XML files.

Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. =20
When fetching a remote resource via FTP or HTTP, libxml2 uses special=20
parsing routines. These routines can overflow a buffer if passed a very
long URL. If an attacker is able to find an application using libxml2 that=
=20
parses remote resources and allows them to influence the URL, then this=20
flaw could be used to execute arbitrary code. The Common Vulnerabilities
and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0110=20
to this issue.

All users are advised to upgrade to these updated packages, which contain a=
=20
backported fix and are not vulnerable to this issue.

=46edora Legacy would like to thank Johnny Strom for reporting this issue.

4. Solution:

Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.

Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www fedoralegacy.org/docs for directions on how to configure yum=20
and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1324 - libxml2: an overflow when parsing remote=
=20
resources.

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/red...ml2-2.4.19-5.=
legacy.src.rpm

i386:
http://download.fedoralegacy.org/red...l2-2.4.19-5.l=
egacy.i386.rpm
http://download.fedoralegacy.org/red...l2-python-2.4=
=2E19-5.legacy.i386.rpm
http://download.fedoralegacy.org/red...l2-devel-2.4.=
19-5.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---

7ea6c8e40a04c2eafb82d53e8e6931b27348f4ad =20
7.3/updates/SRPMS/libxml2-2.4.19-5.legacy.src.rpm
c325b2b9d03335b41db6b0b462a35d1ed847e56f =20
7.3/updates/i386/libxml2-2.4.19-5.legacy.i386.rpm
c53f70cad435630b3e5b5f5d363c7d425f980a35 =20
7.3/updates/i386/libxml2-devel-2.4.19-5.legacy.i386.rpm
8819fa789731693645839f32f55aac2f2dc27906 =20
7.3/updates/i386/libxml2-python-2.4.19-5.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename...DCAN-2004-0110
https://www.redhat.com/archives/redh...y/msg00007.ht=
ml
http://mail.gnome.org/archives/xml/2.../msg00070.html


9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org

=2D ---------------------------------------------------------------------

=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
GPG Public Key (http://geek.j2solutions.net/jkeating.j2solutions.pub)

Was I helpful? Let others know:
http://svcs.affero.net/rm.php?r=3Djkeating
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFA/JVx4v2HLvE71NURAk+sAKCtr5UVXfrGLhkoHxfi5BHyDLtBmQC gum0l
5hirw0+x3WPmJhPz+nqydX4=3D
=3DXs3j
=2D----END PGP SIGNATURE-----