Security update for libxml2
This update for libxml2 fixes the following issues: * CVE-2016-4658: use-after-free error could lead to crash [bsc#1005544] * Fix NULL dereference in xpointer.c when in recovery mode [bsc#1014873] * CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS (bsc#1017497). For CVE-2016-9318 we decided not to ship a fix since it can break existing setups. Please take appropriate actions if you parse untrusted XML files and use the new -noxxe flag if possible (bnc#1010675, bnc#1013930).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for libxml2 fixes the following issues: * CVE-2016-4658: use-after-free error could lead to crash [bsc#1005544] * Fix NULL dereference in xpointer.c when in recovery mode [bsc#1014873] * CVE-2016-9597: An XML document with many opening tags could have caused a overflow of the stack not detected by the recursion limits, allowing for DoS (bsc#1017497). For CVE-2016-9318 we decided not to ship a fix since it can break existing setups. Please take appropriate actions if you parse untrusted XML files and use the new -noxxe flag if possible (bnc#1010675, bnc#1013930).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1005544
- https://bugzilla.suse.com/1010675
- https://bugzilla.suse.com/1013930
- https://bugzilla.suse.com/1014873
- https://bugzilla.suse.com/1017497
- https://www.suse.com/security/cve/CVE-2016-4658
- https://www.suse.com/security/cve/CVE-2016-9318
- https://www.suse.com/security/cve/CVE-2016-9597
- https://www.suse.com/support/update/announcement/2017/suse-su-20170380-1/