python-libxml2-2.9.4-1.4 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10228-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z python-libxml2-2.9.4-1.4 on GA media These are all security issues fixed in the python-libxml2-2.9.4-1.4 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10228 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2008-4225/ SUSE CVE CVE-2008-4225 page https://www.suse.com/security/cve/CVE-2008-4226/ SUSE CVE CVE-2008-4226 page https://www.suse.com/security/cve/CVE-2008-4409/ SUSE CVE CVE-2008-4409 page https://www.suse.com/security/cve/CVE-2012-5134/ SUSE CVE CVE-2012-5134 page https://www.suse.com/security/cve/CVE-2016-1762/ SUSE CVE CVE-2016-1762 page https://www.suse.com/security/cve/CVE-2016-1833/ SUSE CVE CVE-2016-1833 page https://www.suse.com/security/cve/CVE-2016-1834/ SUSE CVE CVE-2016-1834 page https://www.suse.com/security/cve/CVE-2016-1835/ SUSE CVE CVE-2016-1835 page https://www.suse.com/security/cve/CVE-2016-1836/ SUSE CVE CVE-2016-1836 page https://www.suse.com/security/cve/CVE-2016-1837/ SUSE CVE CVE-2016-1837 page https://www.suse.com/security/cve/CVE-2016-1838/ SUSE CVE CVE-2016-1838 page https://www.suse.com/security/cve/CVE-2016-1839/ SUSE CVE CVE-2016-1839 page https://www.suse.com/security/cve/CVE-2016-1840/ SUSE CVE CVE-2016-1840 page https://www.suse.com/security/cve/CVE-2016-3627/ SUSE CVE CVE-2016-3627 page https://www.suse.com/security/cve/CVE-2016-3705/ SUSE CVE CVE-2016-3705 page https://www.suse.com/security/cve/CVE-2016-4483/ SUSE CVE CVE-2016-4483 page openSUSE Tumbleweed python-libxml2-2.9.4-1.4 python-libxml2-2.9.4-1.4 as a component of openSUSE Tumbleweed Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document. CVE-2008-4225 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-4225.html CVE-2008-4225 https://bugzilla.suse.com/445677 SUSE Bug 445677 Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document. CVE-2008-4226 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 critical 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-4226.html CVE-2008-4226 https://bugzilla.suse.com/441368 SUSE Bug 441368 libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash), as demonstrated by use of xmllint on a certain XML document, a different vulnerability than CVE-2003-1564 and CVE-2008-3281. CVE-2008-4409 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-4409.html CVE-2008-4409 https://bugzilla.suse.com/432486 SUSE Bug 432486 Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. CVE-2012-5134 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2012-5134.html CVE-2012-5134 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/791234 SUSE Bug 791234 https://bugzilla.suse.com/793334 SUSE Bug 793334 https://bugzilla.suse.com/795039 SUSE Bug 795039 https://bugzilla.suse.com/804033 SUSE Bug 804033 The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1762 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1762.html CVE-2016-1762 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981040 SUSE Bug 981040 The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1833 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1833.html CVE-2016-1833 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981108 SUSE Bug 981108 Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1834 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1834.html CVE-2016-1834 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981041 SUSE Bug 981041 Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1835 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1835.html CVE-2016-1835 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981109 SUSE Bug 981109 Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1836 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1836.html CVE-2016-1836 https://bugzilla.suse.com/1174862 SUSE Bug 1174862 https://bugzilla.suse.com/981110 SUSE Bug 981110 Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1837 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1837.html CVE-2016-1837 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981111 SUSE Bug 981111 The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1838 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1838.html CVE-2016-1838 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981112 SUSE Bug 981112 The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1839 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1839.html CVE-2016-1839 https://bugzilla.suse.com/1039069 SUSE Bug 1039069 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/1069433 SUSE Bug 1069433 https://bugzilla.suse.com/1069690 SUSE Bug 1069690 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/963963 SUSE Bug 963963 https://bugzilla.suse.com/981114 SUSE Bug 981114 Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1840 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-1840.html CVE-2016-1840 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/981115 SUSE Bug 981115 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. CVE-2016-3627 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-3627.html CVE-2016-3627 https://bugzilla.suse.com/1026099 SUSE Bug 1026099 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/972335 SUSE Bug 972335 https://bugzilla.suse.com/975947 SUSE Bug 975947 The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. CVE-2016-3705 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-3705.html CVE-2016-3705 https://bugzilla.suse.com/1017497 SUSE Bug 1017497 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/975947 SUSE Bug 975947 The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. CVE-2016-4483 openSUSE Tumbleweed:python-libxml2-2.9.4-1.4 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-4483.html CVE-2016-4483 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/1123919 SUSE Bug 1123919 https://bugzilla.suse.com/978395 SUSE Bug 978395