Xmlsoft libxml2资源管理错误漏洞

admin

0
文章

0
评论

2022-07-23 15:03:24 CNNVD漏洞来源：ZONE.CI 全球网 0 阅读模式

漏洞信息详情

Xmlsoft libxml2资源管理错误漏洞

CNNVD编号：CNNVD-200908-097
危害等级：中危
CVE编号： CVE-2009-2416
漏洞类型：资源管理错误
发布时间： 2009-08-11
威胁类型：远程
更新时间： 2009-08-13
厂商： xmlsoft
漏洞来源： Jan Lieskovsky※ jl...

漏洞简介

libxml2软件包提供允许用户操控XML文件的函数库，包含有读、修改和写XML和HTML文件支持。

libxml库处理DTD中根XML文档元素定义的方式存在资源管理错误漏洞，解析Notation和Enumeration属性类型的方式存在多个释放后使用漏洞。远程攻击者可以提供特制的XML文件，如果本地用户受骗打开了该文件，就会导致拒绝服务(应用程序崩溃)。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

https://www.redhat.com/support/errata/RHSA-2009-1206.HTML

参考网址

来源: DEBIAN

名称: DSA-1859

链接:http://www.debian.org/security/2009/dsa-1859

来源: FEDORA

名称: FEDORA-2009-8580

链接:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.HTML

来源: FEDORA

名称: FEDORA-2009-8498

链接:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.HTML

来源: FEDORA

名称: FEDORA-2009-8491

链接:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.HTML

来源: bugzilla.redhat.com

链接:https://bugzilla.redhat.com/show_bug.cgi?id=515205

来源: VUPEN

名称: ADV-2009-3184

链接:http://www.vupen.com/english/advisories/2009/3184

来源: VUPEN

名称: ADV-2009-2420

链接:http://www.vupen.com/english/advisories/2009/2420

来源: UBUNTU

名称: USN-815-1

链接:http://www.ubuntu.com/usn/USN-815-1

来源: BID

名称: 36010

链接:http://www.securityfocus.com/bid/36010

来源: MISC

链接:http://www.networkworld.com/columnists/2009/080509-xml-flaw.HTML

来源: MLIST

名称: [debian-bugs-dist] 20090810 Bug#540865: libxml2: CVE-2009-2414, CVE-2009-2416 pointer-user-after-free and stack overflow because of function recursion

链接:http://www.mail-archive.com/[email protected]/msg678527.HTML

来源: MISC

链接:http://www.codenomicon.com/labs/xml/

来源: MISC

链接:http://www.cert.fi/en/reports/2009/vulnerability2009085.HTML

来源: support.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com

链接:http://support.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/kb/HT3949

来源: support.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com

链接:http://support.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/kb/HT3937

来源: SECUNIA

名称: 36417

链接:http://secunia.com/advisories/36417

来源: SECUNIA

名称: 36338

链接:http://secunia.com/advisories/36338

来源: SECUNIA

名称: 36207

链接:http://secunia.com/advisories/36207

来源: SUSE

名称: SUSE-SR:2009:015

链接:http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.HTML

来源: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple

名称: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple-SA-2009-11-11-1

链接:http://lists.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/archives/security-announce/2009/Nov/msg00001.HTML

来源: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple

名称: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple-SA-2009-11-09-1

链接:http://lists.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/archives/security-announce/2009/Nov/msg00000.HTML

来源: Google CMS.zone.ci/e/tags/htag.php?tag=Chrome target=_blank class=infotextkey>Chromereleases.blogspot.com

链接:http://Google CMS.zone.ci/e/tags/htag.php?tag=Chrome target=_blank class=infotextkey>Chromereleases.blogspot.com/2009/08/stable-update-security-fixes.HTML