SUSE update for libxml2



Published: 2022-05-24
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2017-16932
CVE-2022-29824
CWE-ID CWE-400
CWE-190
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE OpenStack Cloud Crowbar
Operating systems & Components / Operating system

SUSE Linux Enterprise Software Development Kit
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP
Operating systems & Components / Operating system

HPE Helion Openstack
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP Applications
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE OpenStack Cloud
Operating systems & Components / Operating system

libxml2-devel
Operating systems & Components / Operating system package or component

python-libxml2-debugsource
Operating systems & Components / Operating system package or component

python-libxml2-debuginfo
Operating systems & Components / Operating system package or component

python-libxml2
Operating systems & Components / Operating system package or component

libxml2-tools-debuginfo
Operating systems & Components / Operating system package or component

libxml2-tools
Operating systems & Components / Operating system package or component

libxml2-debugsource
Operating systems & Components / Operating system package or component

libxml2-2-debuginfo-32bit
Operating systems & Components / Operating system package or component

libxml2-2-debuginfo
Operating systems & Components / Operating system package or component

libxml2-2-32bit
Operating systems & Components / Operating system package or component

libxml2-2
Operating systems & Components / Operating system package or component

libxml2-doc
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU9542

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-16932

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to improper handling of certain parameter entities. A remote attacker can supply specially constructed XML data, trigger resource exhaustion and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected package libxml2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Software Development Kit: 12-SP5

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server for SAP Applications: 12-SP5

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

libxml2-devel: before 2.9.4-46.54.3

python-libxml2-debugsource: before 2.9.4-46.54.3

python-libxml2-debuginfo: before 2.9.4-46.54.3

python-libxml2: before 2.9.4-46.54.3

libxml2-tools-debuginfo: before 2.9.4-46.54.3

libxml2-tools: before 2.9.4-46.54.3

libxml2-debugsource: before 2.9.4-46.54.3

libxml2-2-debuginfo-32bit: before 2.9.4-46.54.3

libxml2-2-debuginfo: before 2.9.4-46.54.3

libxml2-2-32bit: before 2.9.4-46.54.3

libxml2-2: before 2.9.4-46.54.3

libxml2-doc: before 2.9.4-46.54.3

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221833-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU62741

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29824

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*). A remote attacker can pass specially crafted multi-gigabyte XML file to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package libxml2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Software Development Kit: 12-SP5

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server for SAP Applications: 12-SP5

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

libxml2-devel: before 2.9.4-46.54.3

python-libxml2-debugsource: before 2.9.4-46.54.3

python-libxml2-debuginfo: before 2.9.4-46.54.3

python-libxml2: before 2.9.4-46.54.3

libxml2-tools-debuginfo: before 2.9.4-46.54.3

libxml2-tools: before 2.9.4-46.54.3

libxml2-debugsource: before 2.9.4-46.54.3

libxml2-2-debuginfo-32bit: before 2.9.4-46.54.3

libxml2-2-debuginfo: before 2.9.4-46.54.3

libxml2-2-32bit: before 2.9.4-46.54.3

libxml2-2: before 2.9.4-46.54.3

libxml2-doc: before 2.9.4-46.54.3

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221833-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###