-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 15 Apr 2019 16:56:54 +0100
Source: libxslt
Binary: libxslt1.1 libxslt1-dev libxslt1-dbg xsltproc python-libxslt1 python-libxslt1-dbg
Architecture: source amd64
Version: 1.1.28-2+deb8u4
Distribution: jessie-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
libxslt1-dbg - XSLT 1.0 processing library - debugging symbols
libxslt1-dev - XSLT 1.0 processing library - development kit
libxslt1.1 - XSLT 1.0 processing library - runtime library
python-libxslt1 - Python bindings for libxslt1
python-libxslt1-dbg - Python bindings for libxslt1 (debug extension)
xsltproc - XSLT 1.0 command line processor
Closes: 926895
Changes:
libxslt (1.1.28-2+deb8u4) jessie-security; urgency=high
.
* CVE-2019-11068: Prevent a bypass of a protection mechanisms in the
xsltCheckRead and xsltCheckWrite routines that permit access upon receiving
a -1 error code; xsltCheckRead returned -1 for a specially-crafted URL that
is not actually invalid and the attacker was subsequently authenticated.
(Closes: #926895)
Checksums-Sha1:
5c2657baafd8af39225c8aa47f7a8fa77641289b 2403 libxslt_1.1.28-2+deb8u4.dsc
4df177de629b2653db322bfb891afa3c0d1fa221 3435907 libxslt_1.1.28.orig.tar.gz
5ef43a90f66e77b86e6510fce1bb4ff5602d5e81 38864 libxslt_1.1.28-2+deb8u4.debian.tar.xz
61e97d61e7fab1c69c44f9c0d760814624588cf0 232302 libxslt1.1_1.1.28-2+deb8u4_amd64.deb
4a3592b597275578c71f8cfc31059a0dcd474ff2 513288 libxslt1-dev_1.1.28-2+deb8u4_amd64.deb
13858a79849a21834bed501044c62949adb75abc 479598 libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
cabd30920c080b736e5efd4fd1164c68d9bd842b 118694 xsltproc_1.1.28-2+deb8u4_amd64.deb
26c519232e87df7880e925252307e0b44f9b3873 138940 python-libxslt1_1.1.28-2+deb8u4_amd64.deb
80ed667b02f6977427a8db22cceb31fec920846d 222350 python-libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
Checksums-Sha256:
40350976d950555c803753069fa2415a1d768331c087c1959a47f83157731229 2403 libxslt_1.1.28-2+deb8u4.dsc
5fc7151a57b89c03d7b825df5a0fae0a8d5f05674c0e7cf2937ecec4d54a028c 3435907 libxslt_1.1.28.orig.tar.gz
c7cad1c1c6fe0e2e96d05f258869b4e6a62c82c1c8631f71bad56ac7f4ca6dbc 38864 libxslt_1.1.28-2+deb8u4.debian.tar.xz
b3b33978c64bd5ce0643202825690c99ad971bc483e09ccea2eca6a8efe04983 232302 libxslt1.1_1.1.28-2+deb8u4_amd64.deb
0d635486440dec8161e68a83b85364be00c272cdcae0e9bf577c5a7ee338ca9c 513288 libxslt1-dev_1.1.28-2+deb8u4_amd64.deb
c04a4f241e252a376c4eafc80767dd9d3b4eea6dfcbe7057f09408b95078c1a3 479598 libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
97a3c354988fe0d37a9871143ca9e2176c74810d442f51ae1b88bb6c6f732968 118694 xsltproc_1.1.28-2+deb8u4_amd64.deb
1a8557b1b5c46d26790a809e2b43458151d02506418d241aee7373baf9b83624 138940 python-libxslt1_1.1.28-2+deb8u4_amd64.deb
3318241502279b2e597bc4b7c4821c0a7f886658661362e78985b48f2142447c 222350 python-libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
Files:
fde17cc9aba28993a570f519c9769bc0 2403 text optional libxslt_1.1.28-2+deb8u4.dsc
9667bf6f9310b957254fdcf6596600b7 3435907 text optional libxslt_1.1.28.orig.tar.gz
81812364a51dd512b4700704463dffc7 38864 text optional libxslt_1.1.28-2+deb8u4.debian.tar.xz
c7cdcdd40dc6fc68887a82315f20826b 232302 libs optional libxslt1.1_1.1.28-2+deb8u4_amd64.deb
8dc3632329f5ec323c9616f44d335dbe 513288 libdevel optional libxslt1-dev_1.1.28-2+deb8u4_amd64.deb
4e3a597271df8ce39bfb899ed5dac97e 479598 debug extra libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
ef47c0f327ca1370f6aeddf77519c6f7 118694 text optional xsltproc_1.1.28-2+deb8u4_amd64.deb
de8caab5c778c20f684693fc18745100 138940 python optional python-libxslt1_1.1.28-2+deb8u4_amd64.deb
c527f4278c3e79fb1cb82672f7684019 222350 debug extra python-libxslt1-dbg_1.1.28-2+deb8u4_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAly0q78ACgkQHpU+J9Qx
HliD2g//RC7Bq4MoeLprIX6TENrpzMHglcUfpHLkSKQNXFH2xMQCXin134KOGXY8
v+ADNlKhQCa/9krE+RKi5e37DyLMxQlfvHqrLEFWwN2Tf20tXYVtjClj7h/rDeKe
kZ/WHGoOmIO3Ie17EkBsGLkKrG3DIf6w7jutVg21TrfNv+sWAiv4XQ1JNpmluvQx
X4Vz7YNuB9tuBILyf7HH05nHd31517gDyWZS4mOCPYppXo7lFfPgCNtWeYvv35Cg
ew23fvBSNbquXf4rUkcgj4uk9ALklkKozjxmHUmsxtmzog3xuuuOQCmEL43KZpwQ
wdWGou3m6qXwzD2AI5tt62isWTfqpXvxNnIb4GJMy5+/BfHHwjWkGLG7oGjnUXmi
LmeuJqO/xBsMYPzAOC/R2ujqQT96A3P7TucTaocKO7LZkh4TUbhaHCuKiDe9hKEf
9yGFUsaPMhMHjT9aYVUgr6b712eQSAj2AfAYoV1/Po5EWkOmEM714u/6lsv6/TnQ
dMsGs/VXAPCgDIJXRDxHNv5OrTh2iaCMjGtU3aow8TIhT9fzcHDLqVkaYGa8nYJD
xC3yVAPCVFnlvT8e8ahpKmXSMk4v2B0NAZ+nOkORyP95wmime4zbXrlJJrLKA5z6
LD1+wEwkdCifr2Yhi8ob67ry2pSU9yMzFVRtFmh38tLxEqgmDYg=
=bv4J
-----END PGP SIGNATURE-----