Security update for libxml2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:1594-1 Final 1 1 2016-06-16T08:01:36Z current 2016-06-16T08:01:36Z 2016-06-16T08:01:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libxml2 This update brings libxml2 to version 2.9.4. These security issues were fixed: - CVE-2016-3627: The xmlStringGetNodeList function in tree.c, when used in recovery mode, allowed context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document (bsc#972335). - CVE-2016-1833: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981108). - CVE-2016-1835: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document (bsc#981109). - CVE-2016-1837: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981111). - CVE-2016-1836: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981110). - CVE-2016-1839: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1840 (bsc#981114). - CVE-2016-1838: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1839, and CVE-2016-1840 (bsc#981112). - CVE-2016-1840: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1839 (bsc#981115). - CVE-2016-4483: out-of-bounds read parsing an XML using recover mode (bnc#978395). - CVE-2016-1834: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840 (bsc#981041). - CVE-2016-3705: The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 did not properly keep track of the recursion depth, which allowed context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references (bsc#975947). - CVE-2016-1762: libxml2 allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document (bsc#981040). This non-security issue was fixed: - bnc#983288: Fix attribute decoding during XML schema validation The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html E-Mail link for openSUSE-SU-2016:1594-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 libxml2-2.9.4-7.17.1 libxml2-2-2.9.4-7.17.1 libxml2-2-32bit-2.9.4-7.17.1 libxml2-2-debuginfo-2.9.4-7.17.1 libxml2-2-debuginfo-32bit-2.9.4-7.17.1 libxml2-debugsource-2.9.4-7.17.1 libxml2-devel-2.9.4-7.17.1 libxml2-devel-32bit-2.9.4-7.17.1 libxml2-doc-2.9.4-7.17.1 libxml2-tools-2.9.4-7.17.1 libxml2-tools-debuginfo-2.9.4-7.17.1 python-libxml2-2.9.4-7.17.1 python-libxml2-debuginfo-2.9.4-7.17.1 python-libxml2-debugsource-2.9.4-7.17.1 libxml2-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-2-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-2-32bit-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-2-debuginfo-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-2-debuginfo-32bit-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-debugsource-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-devel-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-devel-32bit-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-doc-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-tools-2.9.4-7.17.1 as a component of openSUSE 13.2 libxml2-tools-debuginfo-2.9.4-7.17.1 as a component of openSUSE 13.2 python-libxml2-2.9.4-7.17.1 as a component of openSUSE 13.2 python-libxml2-debuginfo-2.9.4-7.17.1 as a component of openSUSE 13.2 python-libxml2-debugsource-2.9.4-7.17.1 as a component of openSUSE 13.2 The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1762 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1762.html CVE-2016-1762 https://bugzilla.suse.com/981040 SUSE Bug 981040 The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1833 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1833.html CVE-2016-1833 https://bugzilla.suse.com/981108 SUSE Bug 981108 Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1834 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1834.html CVE-2016-1834 https://bugzilla.suse.com/981041 SUSE Bug 981041 Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1835 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1835.html CVE-2016-1835 https://bugzilla.suse.com/981109 SUSE Bug 981109 Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1836 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1836.html CVE-2016-1836 https://bugzilla.suse.com/981110 SUSE Bug 981110 Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document. CVE-2016-1837 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1837.html CVE-2016-1837 https://bugzilla.suse.com/981111 SUSE Bug 981111 The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1838 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1838.html CVE-2016-1838 https://bugzilla.suse.com/981112 SUSE Bug 981112 The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. CVE-2016-1839 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1839.html CVE-2016-1839 https://bugzilla.suse.com/1039069 SUSE Bug 1039069 https://bugzilla.suse.com/1039661 SUSE Bug 1039661 https://bugzilla.suse.com/963963 SUSE Bug 963963 https://bugzilla.suse.com/981114 SUSE Bug 981114 Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVE-2016-1840 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-1840.html CVE-2016-1840 https://bugzilla.suse.com/981115 SUSE Bug 981115 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. CVE-2016-3627 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-3627.html CVE-2016-3627 https://bugzilla.suse.com/1026099 SUSE Bug 1026099 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/972335 SUSE Bug 972335 https://bugzilla.suse.com/975947 SUSE Bug 975947 The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. CVE-2016-3705 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-3705.html CVE-2016-3705 https://bugzilla.suse.com/975947 SUSE Bug 975947 The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627. CVE-2016-4483 openSUSE 13.2:libxml2-2-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:libxml2-2-debuginfo-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-2.9.4-7.17.1 openSUSE 13.2:libxml2-debugsource-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-2.9.4-7.17.1 openSUSE 13.2:libxml2-devel-32bit-2.9.4-7.17.1 openSUSE 13.2:libxml2-doc-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-2.9.4-7.17.1 openSUSE 13.2:libxml2-tools-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debuginfo-2.9.4-7.17.1 openSUSE 13.2:python-libxml2-debugsource-2.9.4-7.17.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00025.html https://www.suse.com/security/cve/CVE-2016-4483.html CVE-2016-4483 https://bugzilla.suse.com/1026101 SUSE Bug 1026101 https://bugzilla.suse.com/978395 SUSE Bug 978395