RHEL 6 / 7 : libxml2 (RHSA-2016:1292)

critical Nessus Plugin ID 91802

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 18 July 2016] This advisory has been updated to push packages into the Red Hat Enterprise Linux 6 Desktop channels. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es) :

A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or execute arbitrary code with the permissions of the user running the application.
(CVE-2016-1834, CVE-2016-1840)

Multiple denial of service flaws were found in libxml2. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, could cause that application to crash. (CVE-2016-1762, CVE-2016-1833, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449)

Solution

Update the affected packages.

See Also

https://access.redhat.com/errata/RHSA-2016:1292

https://access.redhat.com/security/cve/cve-2016-1762

https://access.redhat.com/security/cve/cve-2016-1833

https://access.redhat.com/security/cve/cve-2016-1834

https://access.redhat.com/security/cve/cve-2016-1835

https://access.redhat.com/security/cve/cve-2016-1836

https://access.redhat.com/security/cve/cve-2016-1837

https://access.redhat.com/security/cve/cve-2016-1838

https://access.redhat.com/security/cve/cve-2016-1839

https://access.redhat.com/security/cve/cve-2016-1840

https://access.redhat.com/security/cve/cve-2016-3627

https://access.redhat.com/security/cve/cve-2016-3705

https://access.redhat.com/security/cve/cve-2016-4447

https://access.redhat.com/security/cve/cve-2016-4448

https://access.redhat.com/security/cve/cve-2016-4449

Plugin Details

Severity: Critical

ID: 91802

File Name: redhat-RHSA-2016-1292.nasl

Version: 2.13

Type: local

Agent: unix

Published: 6/24/2016

Updated: 4/8/2020

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:libxml2, p-cpe:/a:redhat:enterprise_linux:libxml2-debuginfo, p-cpe:/a:redhat:enterprise_linux:libxml2-devel, p-cpe:/a:redhat:enterprise_linux:libxml2-python, p-cpe:/a:redhat:enterprise_linux:libxml2-static, cpe:/o:redhat:enterprise_linux:6, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7.2, cpe:/o:redhat:enterprise_linux:7.3, cpe:/o:redhat:enterprise_linux:7.4, cpe:/o:redhat:enterprise_linux:7.5, cpe:/o:redhat:enterprise_linux:7.6, cpe:/o:redhat:enterprise_linux:7.7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/18/2016

Vulnerability Publication Date: 3/24/2016

Reference Information

CVE: CVE-2016-1762, CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627, CVE-2016-3705, CVE-2016-4447, CVE-2016-4448, CVE-2016-4449

RHSA: 2016:1292