|
Family: Ubuntu Local Security Checks --> Category: infos
USN10-1 : XML library vulnerabilities Vulnerability Scan
Vulnerability Scan Summary XML library vulnerabilities
Detailed Explanation for this Vulnerability Test
Synopsis :
These remote packages are missing security patches :
- libxml2
- libxml2-dev
- libxml2-doc
- libxml2-python2.3
- libxml2-utils
Description :
Several buffer overflows have been discovered in libxml2's FTP connection
and DNS resolution functions. Supplying very long FTP URLs or IP
addresses might result in execution of arbitrary code with the
rights of the process using libxml2.
Since libxml2 is used in packages like php4-imagick, the vulnerability
also might lead to privilege escalation, like executing attacker
supplied code with a web server's rights.
However, this does not affect the core XML parsing code, which is what
the majority of programs use this library for.
Solution :
Upgrade to :
- libxml2-2.6.11-3ubuntu1.1 (Ubuntu 4.10)
- libxml2-dev-2.6.11-3ubuntu1.1 (Ubuntu 4.10)
- libxml2-doc-2.6.11-3ubuntu1.1 (Ubuntu 4.10)
- libxml2-python2.3-2.6.11-3ubuntu1.1 (Ubuntu 4.10)
- libxml2-utils-2.6.11-3ubuntu1.1 (Ubuntu 4.10)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|