Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.4473
xerces-c security update
18 December 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xerces-c
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1311
Reference: ESB-2020.0818
ESB-2020.0813
Original Bulletin:
https://lists.debian.org/debian-security-announce/2020/msg00221.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00025.html
Comment: This bulletin contains two (2) Debian security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4814-1 security@debian.org
https://www.debian.org/security/ Sebastien Delafond
December 17, 2020 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : xerces-c
CVE ID : CVE-2018-1311
Debian Bug : 947431
It was discovered that xerces-c, a validating XML parser library for
C++, did not correctly scan DTDs. The use-after-free vulnerability
resulting from this issue would allow a remote attacker to leverage a
specially crafted XML file in order to crash the application or
potentially execute arbitrary code.
Please note that the patch fixing this issue comes at the expense of a
newly introduced memory leak.
For the stable distribution (buster), this problem has been fixed in
version 3.2.2+debian-1+deb10u1.
We recommend that you upgrade your xerces-c packages.
For the detailed security status of xerces-c please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xerces-c
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAl/bBZQACgkQEL6Jg/PV
nWQAVQgAidQ0lluHvaQwVsE82NY+pWaYDIBH+T23VKAhecLUmUJkB6SZy77FkG4f
36nHuZYm2W+a62OFTwRy3833+OZqgSw9Jdzr4756u5XDBiDRpOaDW99Ra68VJjZl
gh4svlRKUy9LWxeJxgZWoH5HitxOMp56EtsofHk/gdIRP7rRqG6k+mTNSnjjY+GR
wrYqfcuvyP3frP8KJGvm8bX4zlhg14w5WNbnj3pzbgUv0taCXonV/g3TFY/egEdj
wdiXo/5jhCwTAHuhMO+HWIWKuBPRIzYi0lrw1vCJL7YHgbwULYkqyMV1FEVp1FPB
H+HvGCQ7azQ4fAC2GH1x1UzqgxTKpw==
=/MaF
- -----END PGP SIGNATURE-----
- ------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2498-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/
December 17, 2020 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : xerces-c
Version : 3.1.4+debian-2+deb9u2
CVE ID : CVE-2018-1311
Debian Bug : 947431
The UK's National Cyber Security Centre (NCSC) discovered that
Xerces-C, a validating XML parser library for C++, contains a
use-after-free error triggered during the scanning of external
DTDs. An attacker could cause a Denial of Service (DoS) and possibly
achieve remote code execution. This flaw has not been addressed in the
maintained version of the library and has no complete mitigation. The
first is provided by this update which fixes the use-after-free
vulnerability at the expense of a memory leak. The other is to disable
DTD processing, which can be accomplished via the DOM using a standard
parser feature, or via SAX using the XERCES_DISABLE_DTD environment
variable.
For Debian 9 stretch, this problem has been fixed in version
3.1.4+debian-2+deb9u2.
We recommend that you upgrade your xerces-c packages.
For the detailed security status of xerces-c please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xerces-c
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl/bUQwACgkQj/HLbo2J
BZ9J5Af9EcQQqcbWN4A5qbIn8ybHkDJawcRrYygNJdmOmVLDX63rswqt72O7GvZS
IrHcGwgfmMlYXfqcrjxi1cOGZEx4p1Sb+LzkJsYQFo3FCCvkBgyVaUtG8M6Z5tCt
fjMR+cqHS519DXuW/JM8zNq6MJQOVgCxfrF0Da5EeA0jMqd9FVCvzNGY10X8JySp
jvlFJ3DnaYJEnB7KEbxDBbGRGGJASut0/IfSRKxhdz1ednNU0LuQP9Ed4nmsdXBl
WvDM3kheCE3FrHddhbvgsBZmAwZ4QrEfurdoSH4J15CRgD7dj2JhABjDSKVPf8qj
bBq0mqFlxB/RfeqwsRPBfHkuFtsPbw==
=LEUs
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX9v8g+NLKJtyKPYoAQjudw//foljhp2JqVDHtp7eNrIlwsFxIiSok3Uf
BCsHbteZ4Jn8XA5Obgo0SF+5r/7sO/nGD9Xgsv3OqGCXG8jX6+aJw+81mVKPu1Mo
ScvQyVJ4X3qFZ7SjNmUUR3iU2V8+BFcJHCxfuZO5e0rNh3I4E0M+3rWwoPc6F/nh
N3aK0x/ceVTrhGnXA/vxquXrAU+whkG49cyPk64eSP3+lqyoVQb5h2fE0Oy5/66B
3902S3c5j0rtbhLL+iaP8u5t0bdAq8UpFEzqgY/8mcJ8C2rtBKxslj89VC91ggXh
QtWFkhJ30tEO4iwburxMvyMwgf8CuLxNigHz0KGCDQ3wWi/WebwmOHwKoZa70xjL
+TNmXAD+5l7fmkAFrQLlvWowN6sT7uUPgIwno3AUWRAwI+d1R5KEPP7OlfYNWxrj
b40SPrerg3flKEIsa4OVuSnG746zJpydOiU+ImBjF5p3N71rP7zx1nQWaFeetgKv
MO0M3qsDbobbpxvPvrR0QB108+yUYPJsueO7kdiTNI3fIkdVeiNim65UntBXFEnO
tWZf4rib/phQ1BXgPILKbRJn0YrF2HiUcMrNy7GuhImboiS04UZ66R8mNFiafths
xaCn+f48cn2YZcTCYjAKvnbYHzvNoFcCh8pyjzbpv99pYQWm2vDKvywoRpNl/dcn
rK6NhqvbIWU=
=RFaw
-----END PGP SIGNATURE-----