安全公告详情

NS-SA-2021-0061

2021-03-09 14:30:32

简介

important: libxml2/freetype security update

严重级别

important

主题

An update for libxml2/freetype is now available for NewStart CGSL MAIN 6.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

libxml2: This package provides debug information for package python3-libxml2. Debug information is useful when developing applications that use this package or when debugging this package.
freetype: This package provides debug information for package freetype. Debug information is useful when developing applications that use this package or when debugging this package.


Security Fix(es):
libxml2: StringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.(CVE-2020-7595)
libxml2: ParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.(CVE-2019-19956)
libxml2: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service. System availability is the highest threat from this vulnerability.(CVE-2019-20388)
libxml2: bugfix
freetype: Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.(CVE-2020-15999)
freetype: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 6.02.50B5.

影响组件

  • libxml2
  • freetype

影响产品

  • CGSL MAIN 6.02

更新包

{"fix":[{"product":"CGSL MAIN 6.02","pkgs":[{"binary":["python3-libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm","libxml2-static-2.9.7-8.el8.x86_64.rpm","python3-libxml2-2.9.7-8.el8.x86_64.rpm","libxml2-debuginfo-2.9.7-8.el8.x86_64.rpm","libxml2-debugsource-2.9.7-8.el8.x86_64.rpm","libxml2-2.9.7-8.el8.x86_64.rpm","libxml2-devel-2.9.7-8.el8.x86_64.rpm"],"source":"libxml2-2.9.7-8.el8.src.rpm"},{"binary":["freetype-devel-2.9.1-4.el8_3.1.x86_64.rpm","freetype-debugsource-2.9.1-4.el8_3.1.x86_64.rpm","freetype-demos-2.9.1-4.el8_3.1.x86_64.rpm","freetype-demos-debuginfo-2.9.1-4.el8_3.1.x86_64.rpm","freetype-debuginfo-2.9.1-4.el8_3.1.x86_64.rpm","freetype-2.9.1-4.el8_3.1.x86_64.rpm"],"source":"freetype-2.9.1-4.el8_3.1.src.rpm"}]}]}

CVE

参考