libxslt-1.1.17-4.3.0.1.AXS3
エラータID: AXSA:2012-927:01
リリース日:
2012/09/26 Wednesday - 12:13
題名:
libxslt-1.1.17-4.3.0.1.AXS3
影響のあるチャネル:
Asianux Server 3 for x86
Asianux Server 3 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Google Chrome および他の製品で使用される libxslt の xsltGenerateIdFunction 関数には、ヒープメモリアドレスについての重要な情報を取得される脆弱性が存在します。(CVE-2011-1202)
- Google Chrome で使用される libxslt には、サービス運用妨害 (out-of-bounds read) 状態となる脆弱性が存在します。(CVE-2011-3970)
- Google Chrome の XSL の実装には、サービス運用妨害 (不正な読み取り操作) 状態となる脆弱性が存在します。(CVE-2012-2825)
- Google Chrome で使用される libxslt は、メモリを適切に管理しないため、サービス運用妨害 (アプリケーションクラッシュ) 状態となる脆弱性が存在します。(CVE-2012-2870)
- Google Chrome で使用される libxml2 は、XSL 変換処理の間、不特定の変数のキャストを適切にサポートしないため、サービス運用妨害 (DoS) 状態となるなど、不特定の影響を受ける脆弱性が存在します。(CVE-2012-2871)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2011-1202
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
CVE-2011-3970
libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2012-2825
The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
CVE-2012-2870
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
CVE-2012-2871
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
追加情報:
N/A
ダウンロード:
SRPMS
- libxslt-1.1.17-4.3.0.1.AXS3.src.rpm
MD5: 6ee3ee1625f75a9188173eff8264486d
SHA-256: cfe532bcbbbb9e28e2f96ce29e0ab1548d7084b9a121d0042506daafbc998990
Size: 2.62 MB
Asianux Server 3 for x86
- libxslt-1.1.17-4.3.0.1.AXS3.i386.rpm
MD5: cccf2902800d61614d784c7673259fae
SHA-256: 4f761862cda4a05e33eb2febb0c7c3dc972daff0835b95b39cd2f0625995fa0c
Size: 422.72 kB - libxslt-devel-1.1.17-4.3.0.1.AXS3.i386.rpm
MD5: 43632d7b44f8f02b16b5afde93a4876a
SHA-256: e7774542fa9acd87c0a0d3bdc3130f34a275f602cd45754fe4192bf94ddbbdcb
Size: 231.39 kB - libxslt-python-1.1.17-4.3.0.1.AXS3.i386.rpm
MD5: c68d12ef62c6907d2b420bed16ca08eb
SHA-256: da9cbf5a8ab9fb162ef2911b48461c8940b6420f81df584fb4e771d01b253cb5
Size: 72.78 kB
Asianux Server 3 for x86_64
- libxslt-1.1.17-4.3.0.1.AXS3.x86_64.rpm
MD5: 86db965e11587cf1f8aa05a4e9cccc9b
SHA-256: 1f06e9d115cfab661174f38b57918b9d61b870cdbab23b714bfe1d7616ed2153
Size: 426.71 kB - libxslt-devel-1.1.17-4.3.0.1.AXS3.x86_64.rpm
MD5: ddcdd59554fb97b09c4b8710e2ecf221
SHA-256: 4ec45d22243757bfce04f75e868fe085c5530ef8113655b5f3044c64456903c4
Size: 242.91 kB - libxslt-python-1.1.17-4.3.0.1.AXS3.x86_64.rpm
MD5: 2a3037c3206dc37a79d6f861aba99ce7
SHA-256: 60e91ddc69ed4d2890eb6bd3df56d544a50160d843d5cdbd2df39e365a2cb1d6
Size: 73.43 kB