From: Marc Deslauriers Reply-To: Ubuntu Security To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <57683228.8060901@canonical.com> Subject: [USN-3013-1] XML-RPC for C and C++ vulnerabilities ============================================================================ Ubuntu Security Notice USN-3013-1 June 20, 2016 xmlrpc-c vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: Several security issues were fixed in XML-RPC for C and C++. Software Description: - xmlrpc-c: Lightweight RPC library based on XML and HTTP Details: It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly called srand in certain circumstances. This could reduce the security of calling applications. (CVE-2012-6702) It was discovered that the Expat code in XML-RPC for C and C++ incorrectly handled seeding the random number generator. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-5300) Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++ incorrectly handled malformed XML data. If a user or application linked against XML-RPC for C and C++ were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2016-0718) It was discovered that the Expat code in XML-RPC for C and C++ incorrectly handled malformed XML data. If a user or application linked against XML-RPC for C and C++ were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2015-1283, CVE-2016-4472) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: libxmlrpc-c++4 1.16.33-3.1ubuntu5.2 libxmlrpc-core-c3 1.16.33-3.1ubuntu5.2 After a standard system upgrade you need to restart any applications linked against XML-RPC for C and C++ to effect the necessary changes. References: http://www.ubuntu.com/usn/usn-3013-1 CVE-2012-6702, CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2016-5300 Package Information: https://launchpad.net/ubuntu/+source/xmlrpc-c/1.16.33-3.1ubuntu5.2