Your message dated Wed, 05 Nov 2014 23:47:06 +0000
with message-id <e1xmai6-0007r4...@franck.debian.org>
and subject line Bug#765722: fixed in libxml2 2.8.0+dfsg1-7+wheezy2
has caused the Debian Bug report #765722,
regarding CVE-2014-3660 libxml2 billion laugh variant
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
765722: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=765722
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: libxml2
Severity: serious
Tags: security patch
Hi,
The Netherlands Cyber Security Center announced an issue in libxml2.
https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html
It seems to be a variant of the classic 'billion laughs' vulnerability.
Upstream has fixed this in 2.9.2:
https://git.gnome.org/browse/libxml2/commit/?id=be2a7edaf289c5da74a4f9ed3a0b6c733e775230
Cheers,
Thijs
--- End Message ---
--- Begin Message ---
Source: libxml2
Source-Version: 2.8.0+dfsg1-7+wheezy2
We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 765...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Aron Xu <a...@debian.org> (supplier of updated libxml2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 26 Oct 2014 12:39:34 +0800
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg
libxml2-doc python-libxml2 python-libxml2-dbg
Architecture: source amd64 all
Version: 2.8.0+dfsg1-7+wheezy2
Distribution: stable-security
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-p...@lists.alioth.debian.org>
Changed-By: Aron Xu <a...@debian.org>
Description:
libxml2 - GNOME XML library
libxml2-dbg - Debugging symbols for the GNOME XML library
libxml2-dev - Development files for the GNOME XML library
libxml2-doc - Documentation for the GNOME XML library
libxml2-utils - XML utilities
libxml2-utils-dbg - XML utilities (debug extension)
python-libxml2 - Python bindings for the GNOME XML library
python-libxml2-dbg - Python bindings for the GNOME XML library (debug
extension)
Closes: 762864 765722 765770
Changes:
libxml2 (2.8.0+dfsg1-7+wheezy2) stable-security; urgency=high
.
* Fix buggy patch (Closes: #765770)
* Fix wrongly applied patch for CVE-2014-0191 (Closes: #762864)
* Add patch for CVE-2014-3660 (Closes: #765722)
Checksums-Sha1:
51107b8fce5d168575e1cf9e497e2e9e428eb86b 2515 libxml2_2.8.0+dfsg1-7+wheezy2.dsc
0e1bdef385ac71a065f9e082565e42e428de9e4b 39792
libxml2_2.8.0+dfsg1-7+wheezy2.debian.tar.gz
f516c2bc62c71ef56eb9a98ae6e9c7b4d281359c 904014
libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
5ec9596ce925f90762d2cf6e2be6ae63464bce64 96650
libxml2-utils_2.8.0+dfsg1-7+wheezy2_amd64.deb
4ac4a26b651be006613fe54a1bd31d498e686db8 127194
libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
535f12d0508faa3b7f11e6533bf787b4f3cd4030 900586
libxml2-dev_2.8.0+dfsg1-7+wheezy2_amd64.deb
ef2f6289b0ceca7b1b3550d93c6e5a7e8ed562ea 1402368
libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
ce2c9c10f34168429151ad81e4d0b8b190788d2c 1356592
libxml2-doc_2.8.0+dfsg1-7+wheezy2_all.deb
c38e04a1f527c972b3df0b72c1139b0f72a3fd9b 345872
python-libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
3ef46a1558ec65c75dd0ee912d21309acb06df7f 727890
python-libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
Checksums-Sha256:
0acf14b87187b18d2a73d6e75f362ebdc9a00c93a873ce41bc8b2c63456a7ecf 2515
libxml2_2.8.0+dfsg1-7+wheezy2.dsc
68ea9779c7ae6553d263cf5ac02652ce9937525fef56011e36c0149cd64a26e9 39792
libxml2_2.8.0+dfsg1-7+wheezy2.debian.tar.gz
23b31dd57be8acfff05d6a0805b5a2ef76b82d5be46a1ba5dde64f049c56f28d 904014
libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
632a040db162747f045dcc773868c9452b499e247475b1169602d23e79c012c2 96650
libxml2-utils_2.8.0+dfsg1-7+wheezy2_amd64.deb
def1f6fa25ebcc8098c1c28f9ec33498a95c44d2ab24a0b21b3f90529e5a7daf 127194
libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
d9440868cc6dd9da5629836e26199525f5b0f2fafe31e1510319a4d4b6b6c79c 900586
libxml2-dev_2.8.0+dfsg1-7+wheezy2_amd64.deb
9b57a91425a4f50ddc720855e1b37b044b083367361cade34600220a379c5d28 1402368
libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
5e13f0a2957b761b844a5fb2b276d111f780f3dd38b6dbe5b1c37912b5340c5a 1356592
libxml2-doc_2.8.0+dfsg1-7+wheezy2_all.deb
0d2a773bd708bb380b1561a3b812a2f6be90ef600fd5f56d7aa0d37d505a3557 345872
python-libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
ba7d9d124e539ce634445b966a05d0ca002865640a5ef8f85d9a048ef015fe06 727890
python-libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
Files:
151af1c37262ba30f412e0daf5642b2e 2515 libs optional
libxml2_2.8.0+dfsg1-7+wheezy2.dsc
45f65a383bc7cd449fae45d1920adbf1 39792 libs optional
libxml2_2.8.0+dfsg1-7+wheezy2.debian.tar.gz
158928748ac3d71e08e43ed1e715cd28 904014 libs standard
libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
a2a49fa622f08bbc4992cbb9eb673592 96650 text optional
libxml2-utils_2.8.0+dfsg1-7+wheezy2_amd64.deb
f4e55e397696b7f34946cdb011bda201 127194 debug extra
libxml2-utils-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
b8190a5205b6e8330b8dec7c537eb691 900586 libdevel optional
libxml2-dev_2.8.0+dfsg1-7+wheezy2_amd64.deb
7a9f940bf35514b425c6d476eed22d4d 1402368 debug extra
libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
88a2f71f2228d35c91c6760821972c5a 1356592 doc optional
libxml2-doc_2.8.0+dfsg1-7+wheezy2_all.deb
1a3f747add9d184da0109516de1f0e02 345872 python optional
python-libxml2_2.8.0+dfsg1-7+wheezy2_amd64.deb
142d9e533d4355718b9f5f2e61721d89 727890 debug extra
python-libxml2-dbg_2.8.0+dfsg1-7+wheezy2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJUTOVfAAoJEMOOgWCheEH+DUEP/1wiSio6nEQ3uUO9ofVoxtfZ
zbDJCfAEtQ8kG5G5nOV+uUsaL9cn35WF75CmHRfni8ExZy6Xf52tcoU8v26zyMh3
KRSJNjd9FYRrS5cKrJvUZV4+BiD0AdVHLbwnCiEQXxwP7h/J2WyKaE31YiNrDUbY
KDH5e9MYDrXNLCZFWdxL0dwTvOIPphTl1oEmT3lgu6chAcYlB5I3dsIIcvpd9LPM
BQfrSz75FcBEXFwEvOUlGvtWcTf4IJFXrcv8NVtHaluRs9WH1IAI2StMf4K19tcG
QKlgJVpTAOKd7Lj9tcn+9jj+BSGlJfhnJuvrwszJ7vwK39eXYpRBw7dRaX6Qr+2+
D8W/xoTSskbZAT03hQ/ckJX33pP/szBCFKmyp+rLaYaiYD9syPHChcZNvW3WfkJW
bdYXMhnGrPSvJulJ2AwOgzsHGE1r9Y8ppMh8H/nLJHr/1Rat3ubLhIbpov7KaoTZ
rIdyVpiCZsPmpVaw3+rcmIbQg4DLsuCFtxKhxGPgNOXvhcJYfHSF1rrYzcW41NjJ
sLOqRr+2z2GKs5nMaD3igas6q9Bd20aWgMvobqtRlAhmumt6ipssOEErD0XzTDmW
DKOFXcJ2SmW3wCPENC7hlwEQ2myNV+JVJ/pd7w7VjXQhXblQd5e6BjZFdpiZlLa6
6aOCRFizjFfFuMWFCBEf
=LsH5
-----END PGP SIGNATURE-----
--- End Message ---
