Security Information / 2012 / Security Information -- DSA-2417-1 libxml2

Debian Security Advisory

DSA-2417-1 libxml2 -- computational denial of service

Date Reported:

22 Feb 2012

Affected Packages:

libxml2

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-0841.

More information:

It was discovered that the internal hashing routine of libxml2, a library providing an extensive API to handle XML data, is vulnerable to predictable hash collisions. Given an attacker with knowledge of the hashing algorithm, it is possible to craft input that creates a large amount of collisions. As a result it is possible to perform denial of service attacks against applications using libxml2 functionality because of the computational overhead.

For the stable distribution (squeeze), this problem has been fixed in version 2.7.8.dfsg-2+squeeze3.

For the testing (wheezy) and unstable (sid) distributions, this problem will be fixed soon.

We recommend that you upgrade your libxml2 packages.