Bug 6025 - libxml2 new security issue CVE-2011-3102
Summary: libxml2 new security issue CVE-2011-3102
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: http://lwn.net/Vulnerabilities/498212/
Whiteboard: mga2-64-OK, mga2-i586-OK, mga1-i586-O...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2012-05-22 21:20 CEST by David Walser
Modified: 2012-06-10 13:39 CEST (History)
4 users (show)

See Also:
Source RPM: libxml2-2.7.8-9.5.mga1.src.rpm
CVE:
Status comment:


Attachments
libxml2-2.7.8-CVE-2011-3102.diff (564 bytes, patch)
2012-05-22 21:30 CEST, David Walser
Details | Diff

Description David Walser 2012-05-22 21:20:08 CEST
Ubuntu has issued an advisory on May 21:
http://www.ubuntu.com/usn/usn-1447-1/

Cauldron/Mageia 2 are also affected.

Patch is here:
http://launchpadlibrarian.net/105753006/libxml2_2.7.8.dfsg-5.1ubuntu4_2.7.8.dfsg-5.1ubuntu4.1.diff.gz
Comment 1 David Walser 2012-05-22 21:30:48 CEST
Created attachment 2360 [details]
libxml2-2.7.8-CVE-2011-3102.diff

Adding the patch as an attachment.
Comment 2 David Walser 2012-05-28 03:04:26 CEST
Patched packages uploaded for Mageia 1, Mageia 2, and Cauldron.

Advisory:
========================

Updated libxml2 packages fix security vulnerabilities:

Juri Aedla discovered that libxml2 contained an off by one error in its
XPointer functionality. If a user or application linked against libxml2
were tricked into opening a specially crafted XML file, an attacker could
cause the application to crash or possibly execute arbitrary code with the
privileges of the user invoking the program (CVE-2011-3102).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3102
http://www.ubuntu.com/usn/usn-1447-1/
========================

Updated packages in core/updates_testing:
========================
libxml2_2-2.7.8-9.6.mga1
libxml2-utils-2.7.8-9.6.mga1
libxml2-python-2.7.8-9.6.mga1
libxml2-devel-2.7.8-9.6.mga1
libxml2_2-2.7.8-14.20120229.2.mga2
libxml2-utils-2.7.8-14.20120229.2.mga2
libxml2-python-2.7.8-14.20120229.2.mga2
libxml2-devel-2.7.8-14.20120229.2.mga2

from SRPMS:
libxml2-2.7.8-9.6.mga1.src.rpm
libxml2-2.7.8-14.20120229.2.mga2.src.rpm

Assignee: bugsquad => qa-bugs

Comment 3 Olivier Delaune 2012-05-30 15:30:17 CEST
Installed on Mageia 2, 64-bits. Everything seems to work fine. Is there any particular point to check to validate this package?

CC: (none) => olivier.delaune

Comment 4 claire robinson 2012-05-30 15:39:15 CEST
It's great that you are helping Olivier, thankyou :)

We do have a page for this one on the wiki..

https://wiki.mageia.org/en/Testing_procedure_for_libxml2
Comment 5 Olivier Delaune 2012-05-30 16:27:44 CEST
Ok, I have followed https://wiki.mageia.org/en/Testing_procedure_for_libxml2
and everything looks good. So I think these packages are validated for me.
Comment 6 claire robinson 2012-06-05 17:28:32 CEST
Tested OK i586 mga2.

Adding some some bits to the whiteboard to help keep track.

Whiteboard: (none) => mga2-64-OK, mga2-i586-OK

Comment 7 Dave Hodgins 2012-06-05 21:49:37 CEST
Testing i586 mga1 shortly.

CC: (none) => davidwhodgins

Comment 8 Dave Hodgins 2012-06-05 21:59:33 CEST
Testing complete on i586 for Mageia 1 for the srpm
libxml2-2.7.8-9.6.mga1.src.rpm

Whiteboard: mga2-64-OK, mga2-i586-OK => mga2-64-OK, mga2-i586-OK, mga1-i586-OK

Comment 9 claire robinson 2012-06-06 15:36:29 CEST
Tested OK mga1 x86_64

Validating

Please see comment for advisory and SRPM's

(Please note this bug contains updates for mga1 and mga2)

Could sysadmin please push both from core/updates_testing to core/updates.

Thanks!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Whiteboard: mga2-64-OK, mga2-i586-OK, mga1-i586-OK => mga2-64-OK, mga2-i586-OK, mga1-i586-OK, mga1-64-OK

Comment 10 claire robinson 2012-06-06 15:37:11 CEST
comment 2 for advisory and srpm's
Comment 11 Thomas Backlund 2012-06-10 13:39:28 CEST
Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0111

CC: (none) => tmb
Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.