[security-announce] libxml2: CVE-2015-7500 : Security Update

Sona Sarmadi sona.sarmadi at enea.com
Thu Feb 25 13:00:16 CET 2016


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

	Enea Linux Security Advisory

=========================================================
Product/package: libxml2 2.9.1
Severity: Medium
CVE Name: CVE-2015-7500
Layer: poky
=========================================================

This security update fixes heap buffer overflow in xmlParseMisc in
libxml2 2.9.1.

Description:
The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows
context-dependent attackers to cause a denial of service
(out-of-bounds heap read) via unspecified vectors related to incorrect
entities boundaries and start tags.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500

Patch is backported from:
http://git.yoctoproject.org/cgit/cgit.cgi/poky/patch/?id=389549c0bbffa6a
956e584fde60db5f0cab5cc1d

Correction for Enea Linux 5.0:
http://git.enea.com/cgit/linux/poky.git/patch/?id=e39962398625aeb780b2f8
a08b194f35ded8b4b8

How to get the latest patches
=============================
- - If you have already cloned meta-enea, update it to get new
security patches.

cd Enea-Linux-5.0/poky
git pull

- - If you have not yet cloned needed repositories, do it as described
below. (All patches are fetched implicitly when cloning the repos).

mkdir Enea-Linux-5.0
git -C Enea-Linux-5.0 clone -b dizzy git://git.enea.com/linux/poky.git
POKY=Enea-Linux-5.0/poky
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-enea.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-fsl-ppc.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
hierofalcon.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-linaro.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
openembedded.git
git -C $POKY clone -b dizzy
git://git.enea.com/linux/meta-virtualization.git
git -C $POKY/meta-enea clone -b dizzy
git://git.enea.com/linux/meta-enea/meta-vt.git


If you have any questions regarding the security patches and security
updates please contact security at enea.com.


Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWzuzPAAoJEAilI68fskZdVsIIAMDAQvYhqIcXIn1F/lDzbYnU
Jzf3yQ2ENW6vQvlkUeDOiWSJz8RDwhX7YiZU/Fv/wML+GXZ0Ratd0HvZf0Bn3wEw
wtkVAGBau3TU69rtkEyWLTBnWTm6JVshfXR4zg8TqTpryOc6DxFaF4b1Vhu66la0
tyyYgOvP9ox+Dq7LLY+5ffTml7vrieDcnvCU8mujyOPTOoYLYdnwUWKo5e1k5i0Z
ZXbX/xqH/db7NsMBpNb8bFbm0KQMTjRJh/CdcbFkSPlWtUW36i6oDLvXqwnHZjuV
d+/qyRzA9xVdlGv+CWyJaCxz9MDxbz+D5W+hwtWptq9NZJ8bLOxy5+FHXE1ObaQ=
=kM3B
-----END PGP SIGNATURE-----



More information about the security-announce mailing list