Moderate: libxml2 security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8710: It was discovered that libxml2 could access out-of-bounds memory when parsing unclosed HTML comments. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, could cause the application to disclose heap memory contents. 1213957: CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment CVE-2015-8317: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information. 1281930: CVE-2015-8317 libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration CVE-2015-8242: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information. 1281950: CVE-2015-8242 libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode CVE-2015-8241: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information. 1281936: CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar CVE-2015-7942: The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941. A heap-based buffer overflow flaw was found in the way libxml2 parsed certain crafted XML input. A remote attacker could provide a specially crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash causing a denial of service. 1276297: CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections() CVE-2015-7941: libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. 1274222: CVE-2015-7941 libxml2: Out-of-bounds memory access CVE-2015-7500: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. 1281943: CVE-2015-7500 libxml2: Heap buffer overflow in xmlParseMisc CVE-2015-7499: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to leak potentially sensitive information. 1281925: CVE-2015-7499 libxml2: Heap-based buffer overflow in xmlGROW CVE-2015-7498: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. 1281879: CVE-2015-7498 libxml2: Heap-based buffer overflow in xmlParseXmlDecl CVE-2015-7497: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash. 1281862: CVE-2015-7497 libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey CVE-2015-5312: A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU. 1276693: CVE-2015-5312 libxml2: CPU exhaustion when processing specially crafted XML input CVE-2015-1819: A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory. 1211278: CVE-2015-1819 libxml2: denial of service processing a crafted XML document