|Category:||SuSE Local Security Checks|
|Title:||SuSE Update for libxml2 openSUSE-SU-2018:3107-1 (libxml2)|
|Summary:||The remote host is missing an update for the 'libxml2'; package(s) announced via the referenced advisory.|
The remote host is missing an update for the 'libxml2'
package(s) announced via the referenced advisory.
This update for libxml2 fixes the following security issues:
- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause
a denial of service (infinite loop) via a crafted XML file that triggers
LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279).
- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted
XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
- CVE-2018-14404: Prevent NULL pointer dereference in the
xmlXPathCompOpEval() function when parsing an invalid XPath expression
in the XPATH_OP_AND or XPATH_OP_OR case leading to a denial of service
- CVE-2017-18258: The xz_head function allowed remote attackers to cause a
denial of service (memory consumption) via a crafted LZMA file, because
the decoder functionality did not restrict memory usage to what is
required for a legitimate file (bsc#1088601).
This update was imported from the SUSE:SLE-12-SP2:Update update project.
To install this openSUSE Security Update use the SUSE recommended
like YaST online_update or 'zypper patch'.
Alternatively you can run the command listed for your product:
- openSUSE Leap 42.3:
zypper in -t patch openSUSE-2018-1149=1
libxml2 on openSUSE Leap 42.3
Please install the updated packages.
Common Vulnerability Exposure (CVE) ID: CVE-2018-9251|
|Copyright||Copyright (C) 2018 Greenbone Networks GmbH|
|This is only one of 71225 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.