CVE-2016-4448
libxml2: Format string vulnerability
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Amazon (yüksek), Oracle (yüksek), Red Hat (orta), Ubuntu (düşük).
Açıklama
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | libxml2, libxml2-debuginfo, libxml2-devel ve 3 tane daha | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | düzeltme belirtilmemiş |
| debian 8 | libxml2 | düzeltme belirtilmemiş |
| echo | libxml2, libxml2-2.9.1 | 2.9.4+dfsg1-1 ve 1 tane daha |
| Oracle Linux 6 | libxml2, libxml2-devel, libxml2-python ve 1 tane daha | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2, libxml2-devel, libxml2-python ve 1 tane daha | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
19 kaynaktaki 32 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | libxml2 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-debuginfo | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-devel | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python26 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-python27 | 2.9.1-6.3.49.amzn1 |
| amazon linux 1 | libxml2-static | 2.9.1-6.3.49.amzn1 |
| debian 11 | libxml2 | 2.9.4+dfsg1-1 |
| debian 12 | libxml2 | 2.9.4+dfsg1-1 |
| debian 13 | libxml2 | 2.9.4+dfsg1-1 |
| debian 14 | libxml2 | 2.9.4+dfsg1-1 |
| debian 7 | libxml2 | düzeltme belirtilmemiş |
| debian 8 | libxml2 | düzeltme belirtilmemiş |
| echo | libxml2 | 2.9.4+dfsg1-1 |
| echo | libxml2-2.9.1 | 2.9.1+e1 |
| Oracle Linux 6 | libxml2 | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-devel | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-python | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 6 | libxml2-static | 2.7.6-21.0.1.el6_8.1 |
| Oracle Linux 7 | libxml2 | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-devel | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-python | 2.9.1-6.0.1.el7_2.3 |
| Oracle Linux 7 | libxml2-static | 2.9.1-6.0.1.el7_2.3 |
| root.io debian 11 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 12 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| root.io debian 13 | rootio-libxml2 | 2.9.4+dfsg1-1 |
| seal Red Hat 6 | libxml2 | 2.7.6-21.el6_8.1+sp999 |
| seal Red Hat 6 | seal-libxml2 | 2.7.6-21.el6_8.1+sp999 |
| ubuntu 12.04 | libxml2 | 2.7.8.dfsg-5.1ubuntu4.17 |
| ubuntu 14.04 | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 14.04-ESM | libxml2 | 2.9.1+dfsg1-3ubuntu4.9 |
| ubuntu 16.04 | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
| ubuntu 16.04-ESM | libxml2 | 2.9.3+dfsg1-1ubuntu0.2 |
Referanslar
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.openwall.com/lists/oss-security/2016/05/25/2
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
33 referansın hepsi
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/90856
- http://www.securitytracker.com/id/1036348
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722
- http://xmlsoft.org/news.html
- https://access.redhat.com/errata/RHSA-2016:1292
- https://access.redhat.com/security/cve/CVE-2016-4448
- https://bugzilla.redhat.com/show_bug.cgi?id=1338700
- https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9
- https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709
- https://kc.mcafee.com/corporate/index?page=content&id=SB10170
- https://linux.oracle.com/cve/CVE-2016-4448.html
- https://linux.oracle.com/errata/ELSA-2016-1292.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-4448
- https://support.apple.com/HT206899
- https://support.apple.com/HT206901
- https://support.apple.com/HT206902
- https://support.apple.com/HT206903
- https://support.apple.com/HT206904
- https://support.apple.com/HT206905
- https://ubuntu.com/security/notices/USN-3235-1
- https://www.cve.org/CVERecord?id=CVE-2016-4448
- https://www.tenable.com/security/tns-2016-18