Detections
Analytics

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:192)

critical Nessus Plugin ID 38013

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A heap-based buffer overflow was found in how libxml2 handled long XML entity names. If an application linked against libxml2 processed untrusted malformed XML content, it could cause the application to crash or possibly execute arbitrary code (CVE-2008-3529).

The updated packages have been patched to prevent this issue. As well, the patch to fix CVE-2008-3281 has been updated to remove the hard-coded entity limit that was set to 5M, instead using XML entity density heuristics. Many thanks to Daniel Veillard of Red Hat for his hard work in tracking down and dealing with the edge cases discovered with the initial fix to this issue.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 38013

File Name: mandriva_MDVSA-2008-192.nasl

Version: 1.16

Type: local

Published: 4/23/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64xml2, p-cpe:/a:mandriva:linux:lib64xml2-devel, p-cpe:/a:mandriva:linux:lib64xml2-python, p-cpe:/a:mandriva:linux:lib64xml2_2, p-cpe:/a:mandriva:linux:libxml2, p-cpe:/a:mandriva:linux:libxml2-devel, p-cpe:/a:mandriva:linux:libxml2-python, p-cpe:/a:mandriva:linux:libxml2-utils, p-cpe:/a:mandriva:linux:libxml2_2, cpe:/o:mandriva:linux:2007.1, cpe:/o:mandriva:linux:2008.0, cpe:/o:mandriva:linux:2008.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/11/2008

Reference Information

CVE: CVE-2008-3281, CVE-2008-3529

BID: 30783, 31126

CWE: 119, 399

MDVSA: 2008:192