BUGTRAQ ID: 30783 CVE(CAN) ID: CVE-2008-3281 libxml2软件包提供允许用户操控XML文件的函数库，包含有读、修改和写XML和HTML文件支持。 libxml2库在解析某些XML内容时没有正确地检查递归深度，使用Libxml2库的应用程序在处理特制XML文档时可能会耗尽所有可用的内存和CPU资源。 XMLSoft Libxml2 2.6.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1631-1）以及相应补丁: DSA-1631-1：New libxml2 packages fix denial of service 链接：<a href=http://www.debian.org/security/2008/dsa-1631 target=_blank>http://www.debian.org/security/2008/dsa-1631</a> 补丁下载： Source archives: <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz</a> Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.dsc target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.dsc</a> Size/MD5 checksum: 901 800082d165a5627f571f019994bee93c <a...
BUGTRAQ ID: 30783 CVE(CAN) ID: CVE-2008-3281 libxml2软件包提供允许用户操控XML文件的函数库，包含有读、修改和写XML和HTML文件支持。 libxml2库在解析某些XML内容时没有正确地检查递归深度，使用Libxml2库的应用程序在处理特制XML文档时可能会耗尽所有可用的内存和CPU资源。 XMLSoft Libxml2 2.6.x 厂商补丁： Debian ------ Debian已经为此发布了一个安全公告（DSA-1631-1）以及相应补丁: DSA-1631-1：New libxml2 packages fix denial of service 链接：<a href=http://www.debian.org/security/2008/dsa-1631 target=_blank>http://www.debian.org/security/2008/dsa-1631</a> 补丁下载： Source archives: <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz</a> Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.dsc target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.dsc</a> Size/MD5 checksum: 901 800082d165a5627f571f019994bee93c <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.diff.gz target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3.diff.gz</a> Size/MD5 checksum: 146017 10fc8479d96fb23d17ac8a51bfe40db9 Architecture independent packages: <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-3_all.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-3_all.deb</a> Size/MD5 checksum: 1325318 11e64cd82ae7b549fa975a657f773f73 alpha architecture (DEC Alpha) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_alpha.deb</a> Size/MD5 checksum: 37976 909bab48a2b4a6c29e11b8b880dd464d <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_alpha.deb</a> Size/MD5 checksum: 184758 2dbe0e48211dff90726296ee6786b73b <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_alpha.deb</a> Size/MD5 checksum: 881704 110adb2bde79f8feb121beaa9ae8e15d <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_alpha.deb</a> Size/MD5 checksum: 916192 fd97550bc89ee18ef4c58da00b2c8b1c <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_alpha.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_alpha.deb</a> Size/MD5 checksum: 820740 47ba8095722f2bbdf6e88fa6881b365e amd64 architecture (AMD x86_64 (AMD64)) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_amd64.deb</a> Size/MD5 checksum: 36774 78fbbff7c5a940d516ddab2145af3a04 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_amd64.deb</a> Size/MD5 checksum: 891114 54574b53e6e1d243c9a3a8db7a7ff845 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_amd64.deb</a> Size/MD5 checksum: 182908 28cfebcd7ab010cf63e9261147be9806 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_amd64.deb</a> Size/MD5 checksum: 746356 96ee63f89da370e08d4d7cf2d656c414 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_amd64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_amd64.deb</a> Size/MD5 checksum: 796450 d9e1bc7ac6e9ac08a50e4cc7fd245433 arm architecture (ARM) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_arm.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_arm.deb</a> Size/MD5 checksum: 672716 21723fdd5875eb16170ec69734fa4cd4 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_arm.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_arm.deb</a> Size/MD5 checksum: 165296 091714fdcb9c7c7909496ac14d9af71d <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_arm.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_arm.deb</a> Size/MD5 checksum: 34676 d1acb4cd2a7036e35a7cfbcdc25362b7 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_arm.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_arm.deb</a> Size/MD5 checksum: 816944 102757770541cb1d1336bb4d3c086aa8 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_arm.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_arm.deb</a> Size/MD5 checksum: 741122 35af939918be6655ca6994462a3b9610 hppa architecture (HP PA RISC) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_hppa.deb</a> Size/MD5 checksum: 192856 0f670bcbefb06ace1dcd643e4045d5ce <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_hppa.deb</a> Size/MD5 checksum: 857960 cc1632c8c04e9582e79e46729ce6657b <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_hppa.deb</a> Size/MD5 checksum: 36856 35450be2eee5c16c4ac8b230b8d67de5 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_hppa.deb</a> Size/MD5 checksum: 863890 fd6b47e9995c8150fe0d42036de52b92 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_hppa.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_hppa.deb</a> Size/MD5 checksum: 849758 3199a4ab9ce81877235f78c611f0ae4e i386 architecture (Intel ia32) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_i386.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_i386.deb</a> Size/MD5 checksum: 857370 6a293fc2b6aeadb289e28a4566fbfc86 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_i386.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_i386.deb</a> Size/MD5 checksum: 681830 2117114ebcaa25a76d21c454df990789 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_i386.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_i386.deb</a> Size/MD5 checksum: 755986 7291a82a169cd4fa7b0d3347685fb3ad <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_i386.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_i386.deb</a> Size/MD5 checksum: 34456 092ad89155004c50686cafca63b9257b <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_i386.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_i386.deb</a> Size/MD5 checksum: 169520 55365fa5e3fe422f0c09492d8289db6b ia64 architecture (Intel ia64) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_ia64.deb</a> Size/MD5 checksum: 1079332 09539a6412b3723ae3a5cda3c3ad9909 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_ia64.deb</a> Size/MD5 checksum: 196528 72eee7603a33f7f06046fed3a7cd19e3 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_ia64.deb</a> Size/MD5 checksum: 1105612 e3ac30716a2199d3c37f50ae7ab1bdc3 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_ia64.deb</a> Size/MD5 checksum: 873890 f3d98ef2b14a8e48a8f8c44ced776b62 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_ia64.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_ia64.deb</a> Size/MD5 checksum: 48492 629a7c71342c5b380fc3e72c7bb8ad16 mipsel architecture (MIPS (Little Endian)) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_mipsel.deb</a> Size/MD5 checksum: 168694 adce98b5257168bdb17c8a7aa0e60131 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_mipsel.deb</a> Size/MD5 checksum: 832722 cea7eaeb7952fa2c204803f004a23c79 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_mipsel.deb</a> Size/MD5 checksum: 768330 94bb5ac441e8ed3b8f14ca21fdcf7b5a <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_mipsel.deb</a> Size/MD5 checksum: 897532 ffeec2f653021b3423f9d94610ca522f <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_mipsel.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_mipsel.deb</a> Size/MD5 checksum: 34404 3b43ed7f884ba01176d6dc9ee8c0ca54 powerpc architecture (PowerPC) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_powerpc.deb</a> Size/MD5 checksum: 897856 b5eacbc0ea09978b887707ed9b23fabb <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_powerpc.deb</a> Size/MD5 checksum: 779568 55f1f4ed3bdb39bc8bc59d74992b91e6 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_powerpc.deb</a> Size/MD5 checksum: 37658 0920a98fef39eabeffc2e6f4083ad6d5 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_powerpc.deb</a> Size/MD5 checksum: 770592 196fb7a7f7636cb5e350a97c4e06c020 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_powerpc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_powerpc.deb</a> Size/MD5 checksum: 172722 64c1948d58bbf8b9094234715fca2509 s390 architecture (IBM S/390) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_s390.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_s390.deb</a> Size/MD5 checksum: 749806 20d00f95a218a47daae2a86342e3222e <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_s390.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_s390.deb</a> Size/MD5 checksum: 885108 5ca88f61170d06854c9c1d9a86f3798d <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_s390.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_s390.deb</a> Size/MD5 checksum: 185726 bdfda7d18d0d0cc5d992e8548ed637f1 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_s390.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_s390.deb</a> Size/MD5 checksum: 36364 9c3b2e9ac8e781bc990616d752752861 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_s390.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_s390.deb</a> Size/MD5 checksum: 805446 f11839b2b45fc83a7972b867094773b2 sparc architecture (Sun SPARC/UltraSPARC) <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-3_sparc.deb</a> Size/MD5 checksum: 781288 3326281769c76631f973ff41682ab4ad <a href=http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-3_sparc.deb</a> Size/MD5 checksum: 176878 60eba89a0a740429b8a8726ebcd175f1 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-3_sparc.deb</a> Size/MD5 checksum: 34578 34b4efd5a8b68a33b85ada99757f824a <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-3_sparc.deb</a> Size/MD5 checksum: 759292 a8e8ea8c000c365ecd2c6a04f0f748d3 <a href=http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_sparc.deb target=_blank>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-3_sparc.deb</a> Size/MD5 checksum: 712758 921af536cdc8ddd105768c4061aa2f3e 补丁安装方法： 1. 手工安装补丁包： 首先，使用下面的命令来下载补丁软件： # wget url (url是补丁下载链接地址) 然后，使用下面的命令来安装补丁： # dpkg -i file.deb (file是相应的补丁名) 2. 使用apt-get自动安装补丁包： 首先，使用下面的命令更新内部数据库： # apt-get update 然后，使用下面的命令安装更新软件包： # apt-get upgrade RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2008:0836-02）以及相应补丁: RHSA-2008:0836-02：Moderate: libxml2 security update 链接：<a href=https://www.redhat.com/support/errata/RHSA-2008-0836.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0836.html</a> XMLSoft ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://svn.gnome.org/viewvc/libxml2?view=revision&revision=3772 target=_blank>http://svn.gnome.org/viewvc/libxml2?view=revision&revision=3772</a>
