[ MDVSA-2008:231 ] libxml2

[dude67]

Drew Yaro of the Apple Product Security Team found two flaws in
libxml2. The first is a denial of service flaw in libxml2's XML
parser. If an application linked against libxml2 were to process
certain malformed XML content, it cause the application to enter an
infinite loop (CVE-2008-4225).

The second is an integer overflow that caused a heap-based buffer
overflow in libxml2's XML parser. If an application linked against
libxml2 were to process certain malformed XML content, it could
cause the application to crash or possibly execute arbitrary code
(CVE-2008-4226).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-4225
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-4226
_______________________________________________________________________