[RHSA-2020:1190-01] Moderate: libxml2 security update

Tue Mar 31 19:43:07 UTC 2020

An update for libxml2 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

The libxml2 library is a development toolbox providing the implementation
of various XML standards.

Security Fix(es):

* libxml2: Use after free triggered by XPointer paths beginning with
range-to (CVE-2016-5131)

* libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate()
function in xpath.c (CVE-2017-15412)

* libxml2: DoS caused by incorrect error detection during XZ decompression
(CVE-2015-8035)

* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in
xpath.c (CVE-2018-14404)

* libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
(CVE-2017-18258)

* libxml2: Infinite loop caused by incorrect error detection during LZMA
decompression (CVE-2018-14567)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The desktop must be restarted (log out, then log back in) for this update
to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1277146 - CVE-2015-8035 libxml2: DoS caused by incorrect error detection during XZ decompression
1358641 - CVE-2016-5131 libxml2: Use after free triggered by XPointer paths beginning with range-to
1523128 - CVE-2017-15412 libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c
1566749 - CVE-2017-18258 libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
1595985 - CVE-2018-14404 libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c
1619875 - CVE-2018-14567 libxml2: Infinite loop caused by incorrect error detection during LZMA decompression

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
libxml2-2.9.1-6.el7.4.src.rpm

x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
libxml2-2.9.1-6.el7.4.src.rpm

x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
libxml2-2.9.1-6.el7.4.src.rpm

ppc64:
libxml2-2.9.1-6.el7.4.ppc.rpm
libxml2-2.9.1-6.el7.4.ppc64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-devel-2.9.1-6.el7.4.ppc.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64.rpm
libxml2-python-2.9.1-6.el7.4.ppc64.rpm

ppc64le:
libxml2-2.9.1-6.el7.4.ppc64le.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64le.rpm
libxml2-python-2.9.1-6.el7.4.ppc64le.rpm

s390x:
libxml2-2.9.1-6.el7.4.s390.rpm
libxml2-2.9.1-6.el7.4.s390x.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-devel-2.9.1-6.el7.4.s390.rpm
libxml2-devel-2.9.1-6.el7.4.s390x.rpm
libxml2-python-2.9.1-6.el7.4.s390x.rpm

x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-static-2.9.1-6.el7.4.ppc.rpm
libxml2-static-2.9.1-6.el7.4.ppc64.rpm

ppc64le:
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-static-2.9.1-6.el7.4.ppc64le.rpm

s390x:
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-static-2.9.1-6.el7.4.s390.rpm
libxml2-static-2.9.1-6.el7.4.s390x.rpm

x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
libxml2-2.9.1-6.el7.4.src.rpm

x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-8035
https://access.redhat.com/security/cve/CVE-2016-5131
https://access.redhat.com/security/cve/CVE-2017-15412
https://access.redhat.com/security/cve/CVE-2017-18258
https://access.redhat.com/security/cve/CVE-2018-14404
https://access.redhat.com/security/cve/CVE-2018-14567
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXoOdR9zjgjWX9erEAQhgbQ/+JolcknqNffv7HQZNxYOtS/M2Zx/E3IB4
QwmkXhfmgV44ig4prUpghE/+O5eTUPjqSq6rHjih/pjCjG4bVcK6BptxBFi7WQwo
GM0ryvm0p0fib0dy+Ov3NNC6Dhg32NIVwC0pWTIEdYcOGBfDY3mXlLXx5aHefisu
p1C7F6rP4xxMRDOlQhAB4UPMkPSD/MtKIyxIEqiAT5olybSTl0um2AB5XtLlCbkT
h4IXDsAyswvBIS/bxnyZkn6oHEiD3JBwcP+ZU0jgSEy34O92ttV7hRQb1H1+YHOO
li1bX5IcbmFzATwBfCZQmNfrp/XU4Ra28GT/3JGntnhhxFmz1xe/h5YNJTwZ+0TX
yxKZdAz3brm/mt6uvbY4PpGERyA+X/Moz4ToXCEL2jVfSXbOuajRtCV8Cp3X7bCd
Ed2imuXZQPpUXNVdF73RJ7YB6vEhQRIdlKgEXzPPpuHFH1HprvSLoJyrDD1T8bfx
TVrrmvtWKtXq0DYSD7wGw23WZJJeUIgyKiZNTlIxvb0c7r8+aZ+toY07sZlBkTCA
cjWNRnHDNkdYH2ZoNPQlzYzk5rSYGqhoOvF85pNCY4v4fofyMEnyAY7MEZ/Z991X
Ko2ShKSzEtKSMcx2B2wPg+hFcACP8HbKxSbW3SzoCSKCOGEAPLQlJ5eHXwLOAO3Q
IZIK7xZywNw=
=8RZh
-----END PGP SIGNATURE-----