[ MDVSA-2014:006 ] libxslt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2014:006
http://www.mandriva.com/en/support/security/

Package : libxslt
Date : January 16, 2014
Affected: Enterprise Server 5.0

Problem Description:

A vulnerability has been discovered and corrected in ejabberd:

xslt.c in libxslt before 1.1.25 allows context-dependent attackers
to cause a denial of service (crash) via a stylesheet that embeds a
DTD, which causes a structure to be accessed as a different type.
NOTE: this issue is due to an incomplete fix for CVE-2012-2825
(CVE-2013-4520).

The updated packages have been patched to correct this issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4520

Updated Packages:

Mandriva Enterprise Server 5:
407874c5ea7e392c07649a0e0e632923 mes5/i586/libxslt1-1.1.24-3.5mdvmes5.2.i586.rpm
b63b9d0072a25cad9cad2bd0bbc4c9f2 mes5/i586/libxslt-devel-1.1.24-3.5mdvmes5.2.i586.rpm
679a497180b32d567486dc5162c6d7ad mes5/i586/libxslt-proc-1.1.24-3.5mdvmes5.2.i586.rpm
99f52b6ed31f93b65cb4cd77827f42f0 mes5/i586/python-libxslt-1.1.24-3.5mdvmes5.2.i586.rpm
6dafabb779ced6b46a4ce854a0120459 mes5/SRPMS/libxslt-1.1.24-3.5mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
34d7d6f66394059ab207f165098d0e61 mes5/x86_64/lib64xslt1-1.1.24-3.5mdvmes5.2.x86_64.rpm
101e3ff312bf499c7aa5e7656060c04b mes5/x86_64/lib64xslt-devel-1.1.24-3.5mdvmes5.2.x86_64.rpm
9d70abdc2ee7a25177a0e9138e723c7f mes5/x86_64/libxslt-proc-1.1.24-3.5mdvmes5.2.x86_64.rpm
928ebd9d861a145055786949d71ee0f9 mes5/x86_64/python-libxslt-1.1.24-3.5mdvmes5.2.x86_64.rpm
6dafabb779ced6b46a4ce854a0120459 mes5/SRPMS/libxslt-1.1.24-3.5mdvmes5.2.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFS1+pgmqjQ0CJFipgRAiQJAJ96V/cZ1Mj0LD7j345jjaZz4FXjhACcC69y
13yLLasjnw+7v6K1d9jgrV0=
=08LZ
-----END PGP SIGNATURE-----