RHSA-2016:1292: Important: libxml2 security update
First published: Thu Jun 23 2016(Updated: )
The libxml2 library is a development toolbox providing the implementation of various XML standards.<br>Security Fix(es):<br>A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application. (CVE-2016-1834, CVE-2016-1840)<br>Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. <br>(CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/libxml2 | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2 | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-debuginfo | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-debuginfo | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-devel | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-devel | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-python | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-static | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-static | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2 | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2 | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-debuginfo | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-debuginfo | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-devel | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-devel | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-python | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-static | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-python | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-static | <2.7.6-21.el6_8.1 | 2.7.6-21.el6_8.1 |
| redhat/libxml2-python | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2 | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-debuginfo | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-devel | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-python | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
| redhat/libxml2-static | <2.9.1-6.el7_2.3 | 2.9.1-6.el7_2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1319829
- https://bugzilla.redhat.com/show_bug.cgi?id=1332443
- https://bugzilla.redhat.com/show_bug.cgi?id=1338682
- https://bugzilla.redhat.com/show_bug.cgi?id=1338686
- https://bugzilla.redhat.com/show_bug.cgi?id=1338691
- https://bugzilla.redhat.com/show_bug.cgi?id=1338696
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700
- https://bugzilla.redhat.com/show_bug.cgi?id=1338701
- https://bugzilla.redhat.com/show_bug.cgi?id=1338702
- https://bugzilla.redhat.com/show_bug.cgi?id=1338703
- https://bugzilla.redhat.com/show_bug.cgi?id=1338705
- https://bugzilla.redhat.com/show_bug.cgi?id=1338706
- https://bugzilla.redhat.com/show_bug.cgi?id=1338708
- https://bugzilla.redhat.com/show_bug.cgi?id=1338711
- http://www.redhat.com/security/updates/classification/#normal
- https://access.redhat.com/errata/RHSA-2016:1292 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2016:1292?
RHSA-2016:1292 is rated as a moderate severity vulnerability due to a heap-based buffer overflow in the libxml2 library.
How do I fix RHSA-2016:1292?
To fix RHSA-2016:1292, update libxml2 to version 2.9.1-6.el7_2.3 or 2.7.6-21.el6_8.1.
Who is affected by vulnerability RHSA-2016:1292?
Vulnerability RHSA-2016:1292 affects users of the libxml2 library in specific versions across Red Hat Enterprise Linux 6 and 7.
What type of vulnerability is RHSA-2016:1292?
RHSA-2016:1292 is classified as a heap-based buffer overflow vulnerability.
Can RHSA-2016:1292 be exploited remotely?
Yes, an attacker can exploit RHSA-2016:1292 remotely by sending a specially crafted XML file.
- agent/severity
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/remedy
- agent/description
- agent/event
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2016:1292
- agent/software-canonical-lookup
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat