Debian Security Advisory
DLA-151-1 libxml2 -- LTS security update
- Date Reported:
- 07 Feb 2015
- Affected Packages:
- libxml2
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 768089.
In Mitre's CVE dictionary: CVE-2014-0191, CVE-2014-3660. - More information:
-
It was discovered that the update released for libxml2 in DSA 2978 fixing CVE-2014-0191 was incomplete. This caused libxml2 to still fetch external entities regardless of whether entity substitution or validation is enabled.
In addition, this update addresses a regression introduced in DSA 3057 by the patch fixing CVE-2014-3660. This caused libxml2 to not parse an entity when it's used first in another entity referenced from an attribute value.
For Debian 6
Squeeze
, these issues have been fixed in libxml2 version 2.7.8.dfsg-2+squeeze11