Synopsis

Moderate: 4Suite security update

Type/Severity

Security Advisory: Moderate

Topic

An updated 4Suite package that fixes one security issue is now available
for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The 4Suite package contains XML-related tools and libraries for Python,
including 4DOM, 4XSLT, 4XPath, 4RDF, and 4XPointer.

A buffer over-read flaw was found in the way 4Suite's XML parser handles
malformed UTF-8 sequences when processing XML files. A specially-crafted
XML file could cause applications using the 4Suite library to crash while
parsing the file. (CVE-2009-3720)

Note: In Red Hat Enterprise Linux 3, this flaw only affects a non-default
configuration of the 4Suite package: configurations where the beta version
of the cDomlette module is enabled.

All 4Suite users should upgrade to this updated package, which contains a
backported patch to correct this issue. After installing the updated
package, applications using the 4Suite XML-related tools and libraries must
be restarted for the update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 531697 - CVE-2009-3720 expat: buffer over-read and crash on XML with malformed UTF-8 sequences

CVEs

• CVE-2009-3720

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
x86_64
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
ia64
4Suite-1.0-3.el4_8.1.ia64.rpm	SHA-256: f46bf42920ed7194c5a27b6673c637c4d73f458809b068e430f792f93143304b
4Suite-1.0-3.el4_8.1.ia64.rpm	SHA-256: f46bf42920ed7194c5a27b6673c637c4d73f458809b068e430f792f93143304b
i386
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0

Red Hat Enterprise Linux Server - Extended Update Support 4.8

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
x86_64
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
ia64
4Suite-1.0-3.el4_8.1.ia64.rpm	SHA-256: f46bf42920ed7194c5a27b6673c637c4d73f458809b068e430f792f93143304b
4Suite-1.0-3.el4_8.1.ia64.rpm	SHA-256: f46bf42920ed7194c5a27b6673c637c4d73f458809b068e430f792f93143304b
i386
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0

Red Hat Enterprise Linux Workstation 4

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
x86_64
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
ia64
4Suite-1.0-3.el4_8.1.ia64.rpm	SHA-256: f46bf42920ed7194c5a27b6673c637c4d73f458809b068e430f792f93143304b
i386
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0

Red Hat Enterprise Linux Desktop 4

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
x86_64
4Suite-1.0-3.el4_8.1.x86_64.rpm	SHA-256: 42e2229b5d4dd8dfe77dd7d6c97e3038e3358a75f260bc458fefe3c942f905a9
i386
4Suite-1.0-3.el4_8.1.i386.rpm	SHA-256: 73b1948f361d8c4117861b8428996bde91844af6da64efc14aa0e33e8e1e65d0

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
s390x
4Suite-1.0-3.el4_8.1.s390x.rpm	SHA-256: 76f2cdd8c9199a678c0e08a709f12839deca63417d17b03948e05be560cd0427
s390
4Suite-1.0-3.el4_8.1.s390.rpm	SHA-256: 97091d93bc854ff01f2fc2cde0ef34905bc386874f559129dad2e6acf8fd0f73

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
s390x
4Suite-1.0-3.el4_8.1.s390x.rpm	SHA-256: 76f2cdd8c9199a678c0e08a709f12839deca63417d17b03948e05be560cd0427
s390
4Suite-1.0-3.el4_8.1.s390.rpm	SHA-256: 97091d93bc854ff01f2fc2cde0ef34905bc386874f559129dad2e6acf8fd0f73

Red Hat Enterprise Linux for Power, big endian 4

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
ppc
4Suite-1.0-3.el4_8.1.ppc.rpm	SHA-256: 1cba9be3360af78e0abf4a5e98b7f82c0c18e03aa10f38e4fb0b2b517a7b3de3

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8

SRPM
4Suite-1.0-3.el4_8.1.src.rpm	SHA-256: 34fb5be4dbf29687e21b7dd91acf272ff3925b9f66f23c8501e6a5b596f8b395
ppc
4Suite-1.0-3.el4_8.1.ppc.rpm	SHA-256: 1cba9be3360af78e0abf4a5e98b7f82c0c18e03aa10f38e4fb0b2b517a7b3de3