Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

USN-3013-1: XML-RPC for C and C++ vulnerabilities

20 June 2016

Several security issues were fixed in XML-RPC for C and C++.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • xmlrpc-c - Lightweight RPC library based on XML and HTTP

Details

It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly
called srand in certain circumstances. This could reduce the security of
calling applications. (CVE-2012-6702)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled seeding the random number generator. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2016-5300)

Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++
incorrectly handled malformed XML data. If a user or application linked
against XML-RPC for C and C++ were tricked into opening a crafted XML file,
an attacker could cause a denial of service, or possibly execute arbitrary
code. (CVE-2016-0718)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled malformed XML data. If a user or application linked against XML-RPC
for C and C++ were tricked into opening a crafted XML file, an attacker
could cause a denial of service, or possibly execute arbitrary code.
(CVE-2015-1283, CVE-2016-4472)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04

After a standard system upgrade you need to restart any applications linked
against XML-RPC for C and C++ to effect the necessary changes.

Related notices

  • USN-3010-1: lib64expat1-dev, libexpat1-udeb, libexpat1, lib64expat1, expat, libexpat1-dev
  • USN-2726-1: lib64expat1-dev, libexpat1-udeb, libexpat1, lib64expat1, expat, libexpat1-dev
  • USN-2677-1: liboxideqtcore0, liboxideqt-qmlplugin, oxideqt-codecs, oxideqt-codecs-extra, oxide-qt, oxideqmlscene, liboxideqtquick0, oxideqt-chromedriver
  • USN-4772-1: vnc4, xvnc4viewer, vnc4server
  • USN-5455-1: libxmltok, libxmltok1, libxmltok1-dev
  • USN-3044-1: firefox-locale-eu, firefox-locale-he, firefox-locale-bn, firefox-locale-mr, firefox-locale-te, firefox-locale-eo, firefox-locale-be, firefox-locale-pa, firefox-locale-vi, firefox-locale-uz, firefox-locale-an, firefox-locale-hu, firefox-locale-gd, firefox-locale-fi, firefox-locale-cs, firefox-locale-nl, firefox-locale-oc, firefox-locale-ko, firefox-locale-fr, firefox-locale-nn, firefox-locale-mai, firefox-locale-sq, firefox-locale-ast, firefox-locale-sw, firefox-locale-kn, firefox-locale-ml, firefox-locale-ms, firefox-dev, firefox-locale-is, firefox-locale-sk, firefox-locale-gn, firefox-locale-km, firefox-locale-ro, firefox-locale-lt, firefox-locale-af, firefox-locale-as, firefox-locale-xh, firefox-locale-si, firefox-locale-gl, firefox-locale-tr, firefox-locale-ga, firefox-locale-th, firefox-locale-sl, firefox-locale-sr, firefox-locale-fy, firefox-globalmenu, firefox-locale-nb, firefox-locale-zh-hant, firefox-locale-en, firefox-locale-cak, firefox-locale-ta, firefox-locale-az, firefox-locale-bg, firefox-locale-hr, firefox-locale-pl, firefox-locale-bs, firefox-locale-et, firefox-locale-csb, firefox-locale-gu, firefox-locale-lg, firefox-locale-cy, firefox-locale-ru, firefox, firefox-locale-hi, firefox-locale-ka, firefox-locale-el, firefox-locale-mn, firefox-locale-pt, firefox-locale-zu, firefox-locale-da, firefox-locale-br, firefox-locale-ca, firefox-testsuite, firefox-locale-hsb, firefox-locale-nso, firefox-mozsymbols, firefox-locale-es, firefox-locale-kk, firefox-locale-it, firefox-locale-ja, firefox-locale-ku, firefox-locale-fa, firefox-locale-or, firefox-locale-zh-hans, firefox-locale-ar, firefox-locale-de, firefox-locale-hy, firefox-locale-lv, firefox-locale-id, firefox-locale-sv, firefox-locale-uk, firefox-locale-mk
  • USN-2983-1: lib64expat1-dev, libexpat1-udeb, libexpat1, lib64expat1, expat, libexpat1-dev