Ubuntu Security Notice 3504-1 - Wei Lei discovered that libxml2 incorrectly handled certain parameter entities. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
2d7133902f073433cd35586f29033e49d7a38a7defd8701eaf17ac23e034f979
==========================================================================
Ubuntu Security Notice USN-3504-1
December 05, 2017
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
libxml2 could be made to crash if it opened a specially crafted
file.
Software Description:
- libxml2: GNOME XML library
Details:
Wei Lei discovered that libxml2 incorrecty handled certain parameter
entities. An attacker could use this issue with specially constructed
XML data to cause libxml2 to consume resources, leading to a denial of
service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
libxml2 2.9.4+dfsg1-4ubuntu1.1
libxml2-utils 2.9.4+dfsg1-4ubuntu1.1
python-libxml2 2.9.4+dfsg1-4ubuntu1.1
python3-libxml2 2.9.4+dfsg1-4ubuntu1.1
Ubuntu 17.04:
libxml2 2.9.4+dfsg1-2.2ubuntu0.2
libxml2-utils 2.9.4+dfsg1-2.2ubuntu0.2
python-libxml2 2.9.4+dfsg1-2.2ubuntu0.2
python3-libxml2 2.9.4+dfsg1-2.2ubuntu0.2
Ubuntu 16.04 LTS:
libxml2 2.9.3+dfsg1-1ubuntu0.4
libxml2-utils 2.9.3+dfsg1-1ubuntu0.4
python-libxml2 2.9.3+dfsg1-1ubuntu0.4
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.11
libxml2-utils 2.9.1+dfsg1-3ubuntu4.11
python-libxml2 2.9.1+dfsg1-3ubuntu4.11
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3504-1
CVE-2017-16932
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-4ubuntu1.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.4+dfsg1-2.2ubuntu0.2
https://launchpad.net/ubuntu/+source/libxml2/2.9.3+dfsg1-1ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.11