Summary
Wei Lei discovered that libxml2 incorrecty handled certain parameter
entities. An attacker could use this issue with specially constructed XML
data to cause libxml2 to consume resources, leading to a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | libxml2 | 2.9.1+dfsg1-3ubuntu4.11 |
| Ubuntu · 16.04 LTS 16.04:LTS | libxml2 | 2.9.3+dfsg1-1ubuntu0.4 |
Vulnerabilities 1
-
High 7.5
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
References
-
report
https://ubuntu.com/security/CVE-2017-16932