[ubuntu/precise-updates] xmlrpc-c 1.16.33-3.1ubuntu5.2 (Accepted)

[Ubuntu Archive Robot]

xmlrpc-c (1.16.33-3.1ubuntu5.2) precise-security; urgency=medium

  * SECURITY UPDATE: integer overflows in xmlrpc_XML_GetBuffer
    - debian/patches/CVE-2015-1283.patch: add checks to
      lib/expat/xmlparse/xmlparse.c.
    - CVE-2015-1283
  * SECURITY UPDATE: integer overflows in xmlrpc_XML_GetBuffer
    - debian/patches/CVE-2016-4472.patch: improved existing fix in
      lib/expat/xmlparse/xmlparse.c.
    - CVE-2016-4472
  * SECURITY UPDATE: unanticipated internal calls to srand
    - debian/patches/CVE-2012-6702-1.patch: remove srand, use more entropy
      in lib/expat/xmlparse/xmlparse.c.
    - debian/patches/CVE-2012-6702-2.patch: use a prime that fits 32bits
      on 32bit platforms in lib/expat/xmlparse/xmlparse.c.
    - CVE-2012-6702
  * SECURITY UPDATE: use of too little entropy
    - debian/patches/CVE-2016-5300-1.patch: extract method
      gather_time_entropy in lib/expat/xmlparse/xmlparse.c.
    - debian/patches/CVE-2016-5300-2.patch: extract entropy from
      XML_Parser address in lib/expat/xmlparse/xmlparse.c.
    - CVE-2016-5300
  * SECURITY UPDATE: denial of service and possible code execution via
    malformed documents
    - debian/patches/CVE-2016-0718.patch: fix out of bounds memory access
      and integer overflow in lib/expat/xmlparse/xmlparse.c,
      lib/expat/xmltok/xmltok.c, lib/expat/xmltok/xmltok.h,
      lib/expat/xmltok/xmltok_impl.c.
    - CVE-2016-0718

Date: 2016-06-16 10:56:13.911082+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/xmlrpc-c/1.16.33-3.1ubuntu5.2
-------------- next part --------------
Sorry, changesfile not available.