DSA-1461-1 libxml2 -- missing input validation

Debian Security Advisory

DSA-1461-1 libxml2 -- missing input validation

Date Reported:

13 Jan 2008

Affected Packages:

libxml2

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2007-6284.

More information:

Brad Fitzpatrick discovered that the UTF-8 decoding functions of libxml2, the GNOME XML library, validate UTF-8 correctness insufficiently, which may lead to denial of service by forcing libxml2 into an infinite loop.

For the old stable distribution (sarge), this problem has been fixed in version 2.6.16-7sarge1.

For the stable distribution (etch), this problem has been fixed in version 2.6.27.dfsg-2.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your libxml2 packages.

Fixed in:

Debian GNU/Linux 3.1 (oldstable)

Source:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.dsc

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1.diff.gz

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.16-7sarge1_all.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-python2.3_2.6.16-7sarge1_all.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.16-7sarge1_all.deb

Alpha:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_arm.deb

HP Precision:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_mips.deb

PowerPC:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.16-7sarge1_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.16-7sarge1_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.16-7sarge1_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.4-libxml2_2.6.16-7sarge1_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.3-libxml2_2.6.16-7sarge1_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python2.2-libxml2_2.6.16-7sarge1_sparc.deb

Debian GNU/Linux 4.0 (stable)

Source:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.diff.gz

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2.dsc

Architecture-independent component:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-2_all.deb

Alpha:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_alpha.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_amd64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_arm.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_arm.deb

HP Precision:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_hppa.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_i386.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_ia64.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_mips.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_mips.deb

PowerPC:

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_powerpc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_s390.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-2_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-2_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-2_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-2_sparc.deb

http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.