Synopsis

Moderate: libxml2 security update

Type/Severity

Security Advisory: Moderate

Topic

An update for libxml2 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libxml2 library is a development toolbox providing the implementation of various XML standards.

Security Fix(es):

• libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)
  
• libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c (CVE-2017-15412)
  
• libxml2: DoS caused by incorrect error detection during XZ decompression (CVE-2015-8035)
  
• libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c (CVE-2018-14404)
  
• libxml2: Unrestricted memory usage in xz_head() function in xzlib.c (CVE-2017-18258)
  
• libxml2: Infinite loop caused by incorrect error detection during LZMA decompression (CVE-2018-14567)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The desktop must be restarted (log out, then log back in) for this update to take effect.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

• BZ - 1277146 - CVE-2015-8035 libxml2: DoS caused by incorrect error detection during XZ decompression
• BZ - 1358641 - CVE-2016-5131 libxml2: Use after free triggered by XPointer paths beginning with range-to
• BZ - 1523128 - CVE-2017-15412 libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c
• BZ - 1566749 - CVE-2017-18258 libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
• BZ - 1595985 - CVE-2018-14404 libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c
• BZ - 1619875 - CVE-2018-14567 libxml2: Infinite loop caused by incorrect error detection during LZMA decompression

CVEs

• CVE-2015-8035
• CVE-2016-5131
• CVE-2017-15412
• CVE-2017-18258
• CVE-2018-14404
• CVE-2018-14567

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index

Red Hat Enterprise Linux Server 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
x86_64
libxml2-2.9.1-6.el7.4.i686.rpm	SHA-256: 81616aa033a26f191f4c1afb13f1ac9c08b0bd45c420a63e5f25e711ee95d05a
libxml2-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 1e53fe8a8d7f585703bce6301cd38464a858edc215f0eee859a30d7689deabed
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-devel-2.9.1-6.el7.4.i686.rpm	SHA-256: 869b10980ef5defdfd2c9541546865e7305ec65e0bf218cade44fd30aad1848a
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e9699a5982450688858685915cd72d32f183dcfbf06e9e024956c159b848887e
libxml2-python-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 975ccc63e079d9c7bfa55ff0aeff63024865383c27ec6d93c7b5b4525da7d4e8
libxml2-static-2.9.1-6.el7.4.i686.rpm	SHA-256: 2a96245b461906b8d8e571bc1ade6266018d67169c1381d78773649ae60ac002
libxml2-static-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e033aa57a52d021a20c47da1ff72b57ac4c385e08773477aae8de3feaee4c56e

Red Hat Enterprise Linux Workstation 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
x86_64
libxml2-2.9.1-6.el7.4.i686.rpm	SHA-256: 81616aa033a26f191f4c1afb13f1ac9c08b0bd45c420a63e5f25e711ee95d05a
libxml2-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 1e53fe8a8d7f585703bce6301cd38464a858edc215f0eee859a30d7689deabed
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-devel-2.9.1-6.el7.4.i686.rpm	SHA-256: 869b10980ef5defdfd2c9541546865e7305ec65e0bf218cade44fd30aad1848a
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e9699a5982450688858685915cd72d32f183dcfbf06e9e024956c159b848887e
libxml2-python-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 975ccc63e079d9c7bfa55ff0aeff63024865383c27ec6d93c7b5b4525da7d4e8
libxml2-static-2.9.1-6.el7.4.i686.rpm	SHA-256: 2a96245b461906b8d8e571bc1ade6266018d67169c1381d78773649ae60ac002
libxml2-static-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e033aa57a52d021a20c47da1ff72b57ac4c385e08773477aae8de3feaee4c56e

Red Hat Enterprise Linux Desktop 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
x86_64
libxml2-2.9.1-6.el7.4.i686.rpm	SHA-256: 81616aa033a26f191f4c1afb13f1ac9c08b0bd45c420a63e5f25e711ee95d05a
libxml2-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 1e53fe8a8d7f585703bce6301cd38464a858edc215f0eee859a30d7689deabed
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-devel-2.9.1-6.el7.4.i686.rpm	SHA-256: 869b10980ef5defdfd2c9541546865e7305ec65e0bf218cade44fd30aad1848a
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e9699a5982450688858685915cd72d32f183dcfbf06e9e024956c159b848887e
libxml2-python-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 975ccc63e079d9c7bfa55ff0aeff63024865383c27ec6d93c7b5b4525da7d4e8
libxml2-static-2.9.1-6.el7.4.i686.rpm	SHA-256: 2a96245b461906b8d8e571bc1ade6266018d67169c1381d78773649ae60ac002
libxml2-static-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e033aa57a52d021a20c47da1ff72b57ac4c385e08773477aae8de3feaee4c56e

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
s390x
libxml2-2.9.1-6.el7.4.s390.rpm	SHA-256: db6355a4fda88ceb110edd5436f8ae325ba02155c6dbafd29128af2b11734eb2
libxml2-2.9.1-6.el7.4.s390x.rpm	SHA-256: ea1740b343612f3e0d6cb846417321973302cc27963dcbaef7d1cde297d8e63c
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm	SHA-256: 1d2ca7c1fb0bc4455001d8ed499bdacf256692f532f7299c4d92f6e1daa40838
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm	SHA-256: 1d2ca7c1fb0bc4455001d8ed499bdacf256692f532f7299c4d92f6e1daa40838
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm	SHA-256: 12af6a4c70f6fddf2d68556c77b2b444cf18b8236666baca85c8548e5a7348e5
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm	SHA-256: 12af6a4c70f6fddf2d68556c77b2b444cf18b8236666baca85c8548e5a7348e5
libxml2-devel-2.9.1-6.el7.4.s390.rpm	SHA-256: c31e074110a879f6e303a620abc09716e7f10e487a863eb0f82838b0b4b64229
libxml2-devel-2.9.1-6.el7.4.s390x.rpm	SHA-256: 241feade5a8fb4562161112d7d197876ab366a034f26e074e579d8e6c349060b
libxml2-python-2.9.1-6.el7.4.s390x.rpm	SHA-256: 1e1bdc001982be237ee747347783b12e3b8585e6b512f08e16569ffdd2a5978b
libxml2-static-2.9.1-6.el7.4.s390.rpm	SHA-256: b6799f505828dbf368365606c5f63406b70556399f172de09c5b6afc95dbe54b
libxml2-static-2.9.1-6.el7.4.s390x.rpm	SHA-256: 8049519d1cb6b28e36b11013e229bced2244674d998443bd1519c14941b5c032

Red Hat Enterprise Linux for Power, big endian 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
ppc64
libxml2-2.9.1-6.el7.4.ppc.rpm	SHA-256: 2d07f337c8e30e4d7e0ac05a1b436823f45fa5883bba15c724c1ace8fb72502f
libxml2-2.9.1-6.el7.4.ppc64.rpm	SHA-256: 3187bf2c52c37011e80c4194da722c30bbdba21a3c362d7717ba7d73de73f5dd
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm	SHA-256: 8361e6f9061ec701d0d3604b6c11758cb16d9b364cfa6a78f20862a43f87a34c
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm	SHA-256: 8361e6f9061ec701d0d3604b6c11758cb16d9b364cfa6a78f20862a43f87a34c
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm	SHA-256: 67b0dd3adb3c32d3fee7f4693c3b46a3f91dfeb798d1ad97371f736e2a53a85b
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm	SHA-256: 67b0dd3adb3c32d3fee7f4693c3b46a3f91dfeb798d1ad97371f736e2a53a85b
libxml2-devel-2.9.1-6.el7.4.ppc.rpm	SHA-256: 4304332b69d32a8d82bc8d9fc03c159e3aea1fc752f6f64d4f2162395611e9ab
libxml2-devel-2.9.1-6.el7.4.ppc64.rpm	SHA-256: c7c95f7a03135f927bb1f9638c30f2aa447389ad6d40ac3247e28d6fc830858f
libxml2-python-2.9.1-6.el7.4.ppc64.rpm	SHA-256: 36ffdd810fd859964815697748bcbf3f9d3072504fdb096a568e60f6046ba995
libxml2-static-2.9.1-6.el7.4.ppc.rpm	SHA-256: 9304e761c4e5bec6d3f17b4321df432fc566f069b07abcf3185f9a4b099290b9
libxml2-static-2.9.1-6.el7.4.ppc64.rpm	SHA-256: ea0794438c7e7e947d2594138d59ffcbab0c6e925c5965cef1d7b50e2156fdc7

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
x86_64
libxml2-2.9.1-6.el7.4.i686.rpm	SHA-256: 81616aa033a26f191f4c1afb13f1ac9c08b0bd45c420a63e5f25e711ee95d05a
libxml2-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 1e53fe8a8d7f585703bce6301cd38464a858edc215f0eee859a30d7689deabed
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm	SHA-256: c7d03dccbc40cb0d26e9576400f9c89e93723e7150c63c29b956690bed980c17
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 3fe3dfc59ec23bead2690b62463c06f01bd3bf116402ccc50a143fc8fb97c3d7
libxml2-devel-2.9.1-6.el7.4.i686.rpm	SHA-256: 869b10980ef5defdfd2c9541546865e7305ec65e0bf218cade44fd30aad1848a
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e9699a5982450688858685915cd72d32f183dcfbf06e9e024956c159b848887e
libxml2-python-2.9.1-6.el7.4.x86_64.rpm	SHA-256: 975ccc63e079d9c7bfa55ff0aeff63024865383c27ec6d93c7b5b4525da7d4e8
libxml2-static-2.9.1-6.el7.4.i686.rpm	SHA-256: 2a96245b461906b8d8e571bc1ade6266018d67169c1381d78773649ae60ac002
libxml2-static-2.9.1-6.el7.4.x86_64.rpm	SHA-256: e033aa57a52d021a20c47da1ff72b57ac4c385e08773477aae8de3feaee4c56e

Red Hat Enterprise Linux for Power, little endian 7

SRPM
libxml2-2.9.1-6.el7.4.src.rpm	SHA-256: 7716f538ede7f4c46ec09f2147dcd1466d310bd0501716406fb4610428dd0367
ppc64le
libxml2-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 257ff422dd507886a221f164e5e6cd69c2eab547ff347ce4d61b24d7f8a86faa
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 32b32a21ddbb553b7f1a49cb016f4db2594e7a79130689dcca82314e79b65d33
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 32b32a21ddbb553b7f1a49cb016f4db2594e7a79130689dcca82314e79b65d33
libxml2-devel-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 8dee8622898b1c24bdfa00b43629b7ec4037c5b52a369101ee532bbeb96e83d2
libxml2-python-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 84f0891e00e85abc656d0b39f251ee91efc3d63154c9bbd44dc02b3c98e8b502
libxml2-static-2.9.1-6.el7.4.ppc64le.rpm	SHA-256: 857af57eb082f223eaef3c9d2040b1c516ffadd91d4cb0e649f45308c6500451