Home / vulnerabilities Mandriva Linux Security Advisory 2015-231
Posted on 07 May 2015
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2015:231
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : perl-XML-LibXML
Date : May 7, 2015
Affected: Business Server 1.0, Business Server 2.0
_______________________________________________________________________
Problem Description:
Updated perl-XML-LibXML package fixes security vulnerability:
Tilmann Haak from xing.com discovered that XML::LibXML did not respect
the expand_entities parameter to disable processing of external
entities in some circumstances. This may allow attackers to gain
read access to otherwise protected ressources, depending on how the
library is used (CVE-2015-3451).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3451
http://advisories.mageia.org/MGASA-2015-0199.html
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
56454d5ba9fb144b9901b6f7e538e162 mbs1/x86_64/perl-XML-LibXML-1.950.0-2.1.mbs1.x86_64.rpm
609fca414b0ee1e0f8b5b4fd562c5d39 mbs1/SRPMS/perl-XML-LibXML-1.950.0-2.1.mbs1.src.rpm
Mandriva Business Server 2/X86_64:
04ec14d6f3d43958adc1d1e61a1a8e9f mbs2/x86_64/perl-XML-LibXML-2.10.0-3.1.mbs2.x86_64.rpm
a65198c480e219b986294f5028c6e4ee mbs2/SRPMS/perl-XML-LibXML-2.10.0-3.1.mbs2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFVSxN8mqjQ0CJFipgRAhnWAJwNSR5i55ZWsaKoOz8oPQWPKD+ftQCgoXqP
E1YT8Ehagy224ecLXt4YDXM=
=/kHO
-----END PGP SIGNATURE-----
