Summary
Ubuntu Update for Linux kernel vulnerabilities USN-644-1
Solution
Please Install the Updated Packages.
Insight
It was discovered that libxml2 did not correctly handle long entity names.
If a user were tricked into processing a specially crafted XML document, a remote attacker could execute arbitrary code with user privileges or cause the application linked against libxml2 to crash, leading to a denial of service. (CVE-2008-3529)
USN-640-1 fixed vulnerabilities in libxml2. When processing extremely large XML documents with valid entities, it was possible to incorrectly trigger the newly added vulnerability protections. This update fixes the problem. (CVE-2008-3281)
Affected
libxml2 vulnerabilities on Ubuntu 6.06 LTS ,
Ubuntu 7.04 ,
Ubuntu 7.10 ,
Ubuntu 8.04 LTS
Severity
Classification
-
CVE CVE-2008-3281, CVE-2008-3529 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities