CVE-2016-4448
libxml2: Format string vulnerability
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Amazon (hoch), Oracle (hoch), Red Hat (mittel), Ubuntu (niedrig).
Beschreibung
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | libxml2, libxml2-debuginfo, libxml2-devel und 3 weitere | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | kein Fix angegeben |
| debian 8 | libxml2 | kein Fix angegeben |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-1 und 1 weitere |
| Oracle Linux 6 | libxml2, libxml2-devel, libxml2-python und 1 weitere | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2, libxml2-devel, libxml2-python und 1 weitere | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
Alle 32 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | libxml2 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-debuginfo | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-devel | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python26 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python27 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-static | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | kein Fix angegeben |
| debian 8 | libxml2 | kein Fix angegeben |
| echo | libxml2 | 2.9.4+dfsg1-1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| Oracle Linux 6 | libxml2 | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-devel | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-python | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-static | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2 | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-devel | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-python | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-static | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| seal Red Hat 6 | libxml2 | 2.7.6-21.el6_8.1+sp999 |
| seal Red Hat 6 | seal-libxml2 | 2.7.6-21.el6_8.1+sp999 |
| ubuntu 12.04 | libxml2 | 2.7.8.dfsg-5.1ubuntu4.17 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
Referenzen
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.openwall.com/lists/oss-security/2016/05/25/2
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Alle 33 Referenzen
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/90856
- http://www.securitytracker.com/id/1036348
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
- http://xmlsoft.org/news.html
- https://access.redhat.com/errata/RHSA-2016:1292
- https://access.redhat.com/security/cve/CVE-2016-4448
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700
- https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
- https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170
- https://linux.oracle.com/cve/CVE-2016-4448.html
- https://linux.oracle.com/errata/ELSA-2016-1292.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-4448
- https://support.apple.com/HT206899
- https://support.apple.com/HT206901
- https://support.apple.com/HT206902
- https://support.apple.com/HT206903
- https://support.apple.com/HT206904
- https://support.apple.com/HT206905
- https://ubuntu.com/security/notices/USN-3235-1
- https://www.cve.org/CVERecord?id=CVE-2016-4448
- https://www.tenable.com/security/tns-2016-18