CVE-2016-4448
libxml2: Format string vulnerability
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Amazon (alta), Oracle (alta), Red Hat (media), Ubuntu (baja).
Descripción
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | libxml2, libxml2-debuginfo, libxml2-devel y 3 más | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | sin corrección indicada |
| debian 8 | libxml2 | sin corrección indicada |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-1 y 1 más |
| Oracle Linux 6 | libxml2, libxml2-devel, libxml2-python y 1 más | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2, libxml2-devel, libxml2-python y 1 más | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
Mostrar las 32 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 1 | libxml2 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-debuginfo | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-devel | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python26 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python27 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-static | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | sin corrección indicada |
| debian 8 | libxml2 | sin corrección indicada |
| echo | libxml2 | 2.9.4+dfsg1-1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| Oracle Linux 6 | libxml2 | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-devel | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-python | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-static | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2 | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-devel | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-python | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-static | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| seal Red Hat 6 | libxml2 | 2.7.6-21.el6_8.1+sp999 |
| seal Red Hat 6 | seal-libxml2 | 2.7.6-21.el6_8.1+sp999 |
| ubuntu 12.04 | libxml2 | 2.7.8.dfsg-5.1ubuntu4.17 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
Referencias
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.openwall.com/lists/oss-security/2016/05/25/2
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Las 33 referencias
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/90856
- http://www.securitytracker.com/id/1036348
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
- http://xmlsoft.org/news.html
- https://access.redhat.com/errata/RHSA-2016:1292
- https://access.redhat.com/security/cve/CVE-2016-4448
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700
- https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
- https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170
- https://linux.oracle.com/cve/CVE-2016-4448.html
- https://linux.oracle.com/errata/ELSA-2016-1292.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-4448
- https://support.apple.com/HT206899
- https://support.apple.com/HT206901
- https://support.apple.com/HT206902
- https://support.apple.com/HT206903
- https://support.apple.com/HT206904
- https://support.apple.com/HT206905
- https://ubuntu.com/security/notices/USN-3235-1
- https://www.cve.org/CVERecord?id=CVE-2016-4448
- https://www.tenable.com/security/tns-2016-18