BUGTRAQ ID: 32326
CVE(CAN) ID: CVE-2008-4226

libxml软件包提供允许用户操控XML文件的函数库，包含有读、修改和写XML和HTML文件支持。

libxml2库的xmlSAX2Characters()函数中存在整数溢出漏洞，如果用户受骗使用链接到该库的应用程序打开了超大的XML文件的话，就可以触发这个溢出，导致执行任意指令。

XMLSoft Libxml2 2.7.2
Debian

Debian已经为此发布了一个安全公告（DSA-1666-1）以及相应补丁:
DSA-1666-1：New libxml2 packages fix several vulnerabilities
链接：<a href=“http://www.debian.org/security/2008/dsa-1666” target=“_blank”>http://www.debian.org/security/2008/dsa-1666</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.dsc</a>
Size/MD5 checksum: 893 b6b2006ffadfb999e72974d574814b7c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg.orig.tar.gz</a>
Size/MD5 checksum: 3416175 5ff71b22f6253a6dd9afc1c34778dec3
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6.diff.gz</a>
Size/MD5 checksum: 147867 d6a3bbbe39bffe96867de82b11c7c5be

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-doc_2.6.27.dfsg-6_all.deb</a>
Size/MD5 checksum: 1328280 c2990030601040775b909c8ace076100

alpha architecture (DEC Alpha)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_alpha.deb</a>
Size/MD5 checksum: 881946 38629543e71a18f6007b8d61d0500e36
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_alpha.deb</a>
Size/MD5 checksum: 821150 f14ee677bb7eac20cd65adef90af0f3c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_alpha.deb</a>
Size/MD5 checksum: 37972 d7757b07f8b0c69f9fd0a07a1598a3e3
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_alpha.deb</a>
Size/MD5 checksum: 184750 020e5ca7663ee88695e1502c8e8af77c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_alpha.deb</a>
Size/MD5 checksum: 917020 f837c687d428d94559bf68e012bc0e02

amd64 architecture (AMD x86_64 (AMD64))

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_amd64.deb</a>
Size/MD5 checksum: 745790 94edf60cc7d02dd31a70376baf740958
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_amd64.deb</a>
Size/MD5 checksum: 892010 a648a6d69a73593739035d78ed3c8436
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_amd64.deb</a>
Size/MD5 checksum: 796410 9f38a5028c33f32cf1701535c1c37984
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_amd64.deb</a>
Size/MD5 checksum: 36682 4de1bfa28b9361e462075451befbe66c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_amd64.deb</a>
Size/MD5 checksum: 184126 1aae3163d718d0c378203b7ea1a53a9b

arm architecture (ARM)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_arm.deb</a>
Size/MD5 checksum: 673236 cda6995615db6e74610d8a51607e85e4
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_arm.deb</a>
Size/MD5 checksum: 817602 c5f81e370d055ba14a40a64d3fbb6e9e
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_arm.deb</a>
Size/MD5 checksum: 34682 4b01403ce80c2949f31559e0eacc044b
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_arm.deb</a>
Size/MD5 checksum: 165284 f84251cc53fa6b67b7fb55f58dd47d5b
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_arm.deb</a>
Size/MD5 checksum: 742176 2e9e6cbbc777d49a99d8a6d98c5dc799

hppa architecture (HP PA RISC)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_hppa.deb</a>
Size/MD5 checksum: 858220 0f8cf389ab60a7639fac0f6499325995
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_hppa.deb</a>
Size/MD5 checksum: 863998 2332655d5ec188cf038cf9fcab862d9f
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_hppa.deb</a>
Size/MD5 checksum: 850370 6c600a26f96c3a3eea898821b0a63937
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_hppa.deb</a>
Size/MD5 checksum: 36852 75d6a8790e01eacb3183e6f295542215
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_hppa.deb</a>
Size/MD5 checksum: 192850 f635c62c33d9a2ea17015b08370dfd8f

i386 architecture (Intel ia32)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_i386.deb</a>
Size/MD5 checksum: 857246 6cebb1b5f8e5e87c00319eb59df9c497
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_i386.deb</a>
Size/MD5 checksum: 169026 31acf12efa0a8f37045f3f0869b894f8
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_i386.deb</a>
Size/MD5 checksum: 681544 f0f383f2ea6ae309bfbcd13f2a2e8efa
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_i386.deb</a>
Size/MD5 checksum: 756128 f776e4a0c28389602bb6b26965fc70ce
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_i386.deb</a>
Size/MD5 checksum: 34496 0cf1427860bb36162af23351285ff091

ia64 architecture (Intel ia64)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_ia64.deb</a>
Size/MD5 checksum: 196528 3eaa55301a20961852f3a3c5b64bde8c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_ia64.deb</a>
Size/MD5 checksum: 48494 280c616ff34b4aa41a48173828b6e66c
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_ia64.deb</a>
Size/MD5 checksum: 1106616 e7b32b8f711337ca52a041af581a05b6
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_ia64.deb</a>
Size/MD5 checksum: 1080448 a7334ed64dba73272b2001e09d18493f
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_ia64.deb</a>
Size/MD5 checksum: 874194 1410e29414572197b6f82dd5a8be061f

mips architecture (MIPS (Big Endian))

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mips.deb</a>
Size/MD5 checksum: 840690 ad2ce083ff5c14656ea3ae28b0fa783d
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mips.deb</a>
Size/MD5 checksum: 770540 d1faeaa723c3de301fb4c8a44ece376a
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mips.deb</a>
Size/MD5 checksum: 34424 c7c9469462957365ab26e7f06e1f0521
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mips.deb</a>
Size/MD5 checksum: 171674 5e6f7cbe84d053bd19dda54346330f75
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mips.deb</a>
Size/MD5 checksum: 926930 c4a3402711ebb05f38b1146eebcd0a71

mipsel architecture (MIPS (Little Endian))

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_mipsel.deb</a>
Size/MD5 checksum: 34396 79f5ff849d9a0ed01ab567ec542b7f3e
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_mipsel.deb</a>
Size/MD5 checksum: 898480 c195cceafe5efce1de168475a462be54
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_mipsel.deb</a>
Size/MD5 checksum: 769244 d0d36bff7e63adf76857166c3ed10daa
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_mipsel.deb</a>
Size/MD5 checksum: 168696 3667deae6585a788c4da731b4fc9383d
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_mipsel.deb</a>
Size/MD5 checksum: 833258 4b1612f79d4b9d1ce2d7086fbb8edbd0

powerpc architecture (PowerPC)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_powerpc.deb</a>
Size/MD5 checksum: 780124 0d2ed3ecc5a1e7a5ce3870fab1bcfc43
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_powerpc.deb</a>
Size/MD5 checksum: 172736 2011f174234c5e939cebeedc2fd9e707
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_powerpc.deb</a>
Size/MD5 checksum: 37662 94991d67033b1b921bb72e5d7bf2b844
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_powerpc.deb</a>
Size/MD5 checksum: 898080 321d90790cf68bc046b9b577e7986438
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_powerpc.deb</a>
Size/MD5 checksum: 771124 47b6d53839ea42f54ae6ad2b89594a26

s390 architecture (IBM S/390)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_s390.deb</a>
Size/MD5 checksum: 36368 fbc5505f4471c4c2fe6ad41903c5596f
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_s390.deb</a>
Size/MD5 checksum: 885484 ead63bcf342e568c9c338c2772ea4e0d
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_s390.deb</a>
Size/MD5 checksum: 750248 ed7465c981212e90fac94dc040ac6bb4
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_s390.deb</a>
Size/MD5 checksum: 185718 414512cb0af24a7c5e3622b75ef9b56f
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_s390.deb</a>
Size/MD5 checksum: 806342 0f85b6120fdba835eaf39d02b4a606d9

sparc architecture (Sun SPARC/UltraSPARC)

<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-utils_2.6.27.dfsg-6_sparc.deb</a>
Size/MD5 checksum: 34578 dd02c5498d378ee75330f8f93b2eb3a7
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dbg_2.6.27.dfsg-6_sparc.deb</a>
Size/MD5 checksum: 781490 ecf288ea66fc19e8f9874b90884a888e
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2-dev_2.6.27.dfsg-6_sparc.deb</a>
Size/MD5 checksum: 713214 434a8a91f3a4acbfc3df2a2707acbbe0
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/libxml2_2.6.27.dfsg-6_sparc.deb</a>
Size/MD5 checksum: 759786 83ba89269fd32296c48c8498e100372b
<a href=“http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb” target=“_blank”>http://security.debian.org/pool/updates/main/libx/libxml2/python-libxml2_2.6.27.dfsg-6_sparc.deb</a>
Size/MD5 checksum: 176878 9840698d19580fe86bfc55a2347361e5

补丁安装方法：

1. 手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

2. 使用apt-get自动安装补丁包：

   首先，使用下面的命令更新内部数据库：

   apt-get update

   然后，使用下面的命令安装更新软件包：

   apt-get upgrade

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2008:0988-01）以及相应补丁:
RHSA-2008:0988-01：Important: libxml2 security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2008-0988.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2008-0988.html</a>