libxslt-1.1.26-2.1.0.1.AXS4
エラータID: AXSA:2012-977:01
リリース日:
2012/12/11 Tuesday - 21:04
題名:
libxslt-1.1.26-2.1.0.1.AXS4
影響のあるチャネル:
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Google Chrome および他の製品で使用される libxslt の xsltGenerateIdFunction 関数には、ヒープメモリアドレスについての重要な情報を取得される脆弱性が存在します。(CVE-2011-1202)
- Google Chrome で使用される libxslt には、サービス運用妨害 (out-of-bounds read) 状態となる脆弱性が存在します。(CVE-2011-3970)
-Google Chrome の XSL の実装には、サービス運用妨害 (不正な読み取り操作) 状態となる脆弱性が存在します。(CVE-2012-2825)
- Google Chrome で使用される libxslt は、メモリを適切に管理しないため、サービス運用妨害 (アプリケーションクラッシュ) 状態となる脆弱性が存在します。(CVE-2012-2870)
- Google Chrome で使用される libxml2 は、XSL 変換処理の間、不特定の変数のキャストを適切にサポートしないため、サービス運用妨害 (DoS) 状態となるなど、不特定の影響を受ける脆弱性が存在します。(CVE-2012-2871)
一部 CVE の翻訳文は JVN からの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2011-1202
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
CVE-2011-3970
libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2012-2825
The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
CVE-2012-2870
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.
CVE-2012-2871
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.
追加情報:
N/A
ダウンロード:
SRPMS
- libxslt-1.1.26-2.1.0.1.AXS4.src.rpm
MD5: 3628996ed7cba6bf3b52e562fa919e42
SHA-256: fe5e36fa06614ea19154ead11f82938475662a70a2486f33878eaeeb2369208e
Size: 3.25 MB
Asianux Server 4 for x86
- libxslt-1.1.26-2.1.0.1.AXS4.i686.rpm
MD5: 9fdf125cde44edc833446cd4b8d9c9c5
SHA-256: 7357f297f926ee3a115d31c985979bcb37165add7d02d5555cef1ea8546a2da7
Size: 449.46 kB - libxslt-devel-1.1.26-2.1.0.1.AXS4.i686.rpm
MD5: 2d8c2c8e081fb0d474a2cdf2c3c5015f
SHA-256: 04f5cc2b27d3a1d2e0877c4bdc8182a68002d8b426912d68bd5b290183a20ce8
Size: 557.08 kB
Asianux Server 4 for x86_64
- libxslt-1.1.26-2.1.0.1.AXS4.x86_64.rpm
MD5: eb7ab6700307dbe8f7a76d33afb56d05
SHA-256: b54d3b69876092b1b260ec5b2ac45f16b14f2c058bff00e4e5ed48098959fda6
Size: 450.37 kB - libxslt-devel-1.1.26-2.1.0.1.AXS4.x86_64.rpm
MD5: 9f547e2a712682a4a884bf51bef9f7d8
SHA-256: 77f94a10d0a40993c15b0c7f6f72c5711e2b8d71c1dc53edae7f717d003a2f39
Size: 559.84 kB - libxslt-1.1.26-2.1.0.1.AXS4.i686.rpm
MD5: 9fdf125cde44edc833446cd4b8d9c9c5
SHA-256: 7357f297f926ee3a115d31c985979bcb37165add7d02d5555cef1ea8546a2da7
Size: 449.46 kB - libxslt-devel-1.1.26-2.1.0.1.AXS4.i686.rpm
MD5: 2d8c2c8e081fb0d474a2cdf2c3c5015f
SHA-256: 04f5cc2b27d3a1d2e0877c4bdc8182a68002d8b426912d68bd5b290183a20ce8
Size: 557.08 kB