Accepted libxml2 2.8.0+dfsg1-7+wheezy5 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 19 Dec 2015 15:25:28 +0100
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg libxml2-doc python-libxml2 python-libxml2-dbg
Architecture: source amd64 all
Version: 2.8.0+dfsg1-7+wheezy5
Distribution: wheezy-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
libxml2 - GNOME XML library
libxml2-dbg - Debugging symbols for the GNOME XML library
libxml2-dev - Development files for the GNOME XML library
libxml2-doc - Documentation for the GNOME XML library
libxml2-utils - XML utilities
libxml2-utils-dbg - XML utilities (debug extension)
python-libxml2 - Python bindings for the GNOME XML library
python-libxml2-dbg - Python bindings for the GNOME XML library (debug extension)
Closes: 782782 782985 783010 802827 803942 806384
Changes:
libxml2 (2.8.0+dfsg1-7+wheezy5) wheezy-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Add patches to address CVE-2015-7941.
CVE-2015-7941: Denial of service via out-of-bounds read. (Closes: #783010)
* Add CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch.
CVE-2015-1819: Enforce the reader to run in constant memory.
Thanks to Mike Gabriel for the patch backport. (Closes: #782782)
* Add patches to address CVE-2015-8317.
CVE-2015-8317: Out-of-bounds heap read when parsing file with unfinished
xml declaration.
* Add patches to address CVE-2015-7942.
CVE-2015-7942: heap-based buffer overflow in
xmlParseConditionalSections(). (Closes: #802827)
* Add Fix-parsing-short-unclosed-comment-uninitialized-acc.patch patch.
Parsing an unclosed comment can result in `Conditional jump or move
depends on uninitialised value(s)` and unsafe memory access.
(Closes: #782985)
* Add CVE-2015-8035-Fix-XZ-compression-support-loop.patch patch.
CVE-2015-8035: DoS when parsing specially crafted XML document if XZ
support is enabled. (Closes: #803942)
* Add Avoid-extra-processing-of-MarkupDecl-when-EOF.patch patch.
CVE-2015-8241: Buffer overread with XML parser in xmlNextChar.
(Closes: #806384)
* Add Avoid-processing-entities-after-encoding-conversion-.patch patch.
CVE-2015-7498: Heap-based buffer overflow in xmlParseXmlDecl.
* Add CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch patch.
CVE-2015-7497: Heap-based buffer overflow in xmlDictComputeFastQKey.
* Add CVE-2015-5312-Another-entity-expansion-issue.patch patch.
CVE-2015-5312: CPU exhaustion when processing specially crafted XML
input.
* Add patches to address CVE-2015-7499.
CVE-2015-7499: Heap-based buffer overflow in xmlGROW.
Add a specific parser error (XML_ERR_USER_STOP), backported from
e50ba8164eee06461c73cd8abb9b46aa0be81869 upstream (commit to address
CVE-2013-2877, the "Try to stop parsing as quickly as possible" was not
backported).
* Add CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch patch.
CVE-2015-7500: Heap buffer overflow in xmlParseMisc.
Checksums-Sha1:
288964c2971b07359e0d1da50497c032157c4fc6 2500 libxml2_2.8.0+dfsg1-7+wheezy5.dsc
a0fcbc474df4bfaa2a1c6711615ba5a7d79a1208 52569 libxml2_2.8.0+dfsg1-7+wheezy5.debian.tar.gz
f0b48ad89ecf03785bd5e0a4426e240c866debe8 906394 libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
586bb37db8a93138431c3f82e70edb6a9ca34be0 97750 libxml2-utils_2.8.0+dfsg1-7+wheezy5_amd64.deb
9fe4a33411ce00a2f154b8c738f3c66a991f4726 128438 libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
be65e2f8d70d3617162bec08930bfeb7ddd0661a 904114 libxml2-dev_2.8.0+dfsg1-7+wheezy5_amd64.deb
9eff034a330f6ea6c4b406533e66bc6590baf4af 1403666 libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
1b4cf22fda8d5155bad1f18fa0531dc19654b780 1398210 libxml2-doc_2.8.0+dfsg1-7+wheezy5_all.deb
af3bb078f593e1957c5e48642a5fa88f09a714e0 347140 python-libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
36341f7a5caddf119711ff4c13b06e476959794a 729548 python-libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
Checksums-Sha256:
454b8a84b9c34a9ebd61c003756211fa6dcf6080f2cb415217bb339bad6fbb4f 2500 libxml2_2.8.0+dfsg1-7+wheezy5.dsc
599affacd35df3b12f2860990469d59235c4c8446051b578de0f9666126eca5b 52569 libxml2_2.8.0+dfsg1-7+wheezy5.debian.tar.gz
d407b28f5397676ef7122b6196e087bf806d613ca43a68494c80e743235f30f7 906394 libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
ce33a35a137f09d1f9d77fb1fd6dce3ac4a19c3f16bee087eb3e768bf880ab3b 97750 libxml2-utils_2.8.0+dfsg1-7+wheezy5_amd64.deb
c3623fa4a037571ec2b8b726bfcb06aeccfe6dee953a64ea6b8b2b93d1cd1d92 128438 libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
3cf0d5b5ea97818a470abb2ca7b9b258c445a469d937518cd2a82421a4244de3 904114 libxml2-dev_2.8.0+dfsg1-7+wheezy5_amd64.deb
3e24c0b57c5b327c6e192d94f5a5972c4f42f1552ff7730b5b1583b9ad216326 1403666 libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
ec9a9a8123261fbb49a46e3e824690f67145a5521a8bd7a2767fcc1ed3e7256c 1398210 libxml2-doc_2.8.0+dfsg1-7+wheezy5_all.deb
2a9a75641a2573b238a7ff821e88eb829552d5dd5d499e7c21b6a7be264031f4 347140 python-libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
5a08fe8a0e138c3bf7a0e14c1ddef5f7597b256060fef505e8b81b35ccfe609a 729548 python-libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
Files:
5ca9fbed5febc8572bc0b8deb83a53aa 2500 libs optional libxml2_2.8.0+dfsg1-7+wheezy5.dsc
21a4180463465e1222033008edc782ed 52569 libs optional libxml2_2.8.0+dfsg1-7+wheezy5.debian.tar.gz
2092576dba6892701056668969758669 906394 libs standard libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
3c7fa309df5585c539ba4c83c8e096d6 97750 text optional libxml2-utils_2.8.0+dfsg1-7+wheezy5_amd64.deb
0aadd85a7532b2ffd00b2bb80161f94e 128438 debug extra libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
a86b1a8606b96128e275986140571034 904114 libdevel optional libxml2-dev_2.8.0+dfsg1-7+wheezy5_amd64.deb
30520c11a1f24c3cc36dd974dfd4b317 1403666 debug extra libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
70c4278129396532ca6a3fe0636b952c 1398210 doc optional libxml2-doc_2.8.0+dfsg1-7+wheezy5_all.deb
54fc8284a5987313e5825bf0dc102002 347140 python optional python-libxml2_2.8.0+dfsg1-7+wheezy5_amd64.deb
0063c9820135120a8870133e3f55d44c 729548 debug extra python-libxml2-dbg_2.8.0+dfsg1-7+wheezy5_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJWdcXjAAoJEAVMuPMTQ89En4AP/3RogvRIvGLby1mnADH5qn8B
imI71JA1BYnwFdjo1CSIRt5P5K1VAUY9hBmYObBn01Kh7+BjP5Lq+TBzNd1jaDxP
XCa1UwkHjHBlMS+MMU0cipSVPr7ogAzfRrzRzEMF/wvQeikU3QVt/2o+zCnsBIW+
ibqEh28ElpBL4Z7C1oaqjVK/oETnF2KhdgOnyhu/RCTQ3RaxjvLZbLnCKP4bS0uL
js1DSiK8jyvX3dRxAMyNo7qR0XgSlTWhqm5yPL3NPazLouEl14FtoMT0Wpls4O7Q
qhKvqJZ5PW9tFljk+J5MdW+dfCOjWtRfqAN9UeUdez+UeLoGhl3bMOBrvlaJ/Fkq
QXOkenqYYhfhJXniTYUyHlTcJhPDnTKLVi6vcAm0VR3OMtFUQ1PdbyfHH4/YbrzD
eSagPMPJHhN3+WOWcgfqIlbsdQv6Qxq1X415dx8CFxNTVGQ0iBt+VqRgSTFQZ2iF
ewbpKSPcWu/eOfwvQpH762UX13dxRuDI2NHDfqyRqQK3Z7Ty+d3ySSjbAK2y+rzD
WPDob6ivOWc5xzkahPR/hdcNOQegQlR+CTdDZNYnh2am0EX7x3ufzlpPspGtqSm9
s5tTLka9EAjZT/zYNM+gP+GSZxc3d72+yz5N3r9MkBELjfWoXL0Oc5YnYTsorB0I
WdU1WCL6XUnuvspnwmsb
=3ALJ
-----END PGP SIGNATURE-----