-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCgAGBQJSgm83AAoJEGVp2FWnRL6TYlIP/2dmRLLFFEG56M1b7UG0s1i0
IAAs+iDEbdLBi9dLIY3KnoTVKnYlYGPVofON9m+Gs76G2TZFNrFuXfm/K8P2MVzi
YkbssrZAWC0HoFHFxS03BrNTFFVBA9tcdNCyesvnP/WXQjrqmYOl3yjeMfFoJqWN
ghpWkYq3YEWY7d1wsCja4Vd6hFSgv9LxSP4x758Q7uiuLHa8pH13FAacfa2ofwJs
r7FXHIHhasa3kY3gWoZmzRIuNFGQC26X1OzKxwtfShqBKDcjnfXR7xm8A+Oa7zVr
M9kozNa2mJmpbBSzJgYZnqa42Cm9TM/2manyM13N0T4YUzW93dYt6yV+IGL4mgUj
DiahxJhsnUhvBiG2yUV1HFOGZ7Vb2Uh+mqN9WBEKU5pU8pZgDmXMC8qJk1ePKk3u
q/3MVSkJtBBcIgtIRcvsHeQBD0P97fCeyL5deDJaFFkml4Byk99SObxCAqQ2TMEQ
+jueNSBVNMJcoRW+CL5P20b9IJKYHCxQH66uFSt5p+idiTclKeTfamtoZnxTK/M5
KQcVaFwt+VW1KHhO7AXyjoZUq24dLUiJVJEiQpESLQvXJszhBBn9pRWw1BUtPQfh
3FNXnNSzCJpd79ZI+n2tw4tYb9QaD15uTLAJR5y0KECQXgDALyY55l+vuibZ8Edf
J9eO1lsewwBXXrUy73SL
=pHvL
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-2028-1
November 12, 2013
libxml-security-java vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Apache XML Security for Java could be tricked into validating spoofed
signatures.
Software Description:
- libxml-security-java: implementation of security standards for XML
Details:
James Forshaw discovered that Apache XML Security for Java incorrectly
validated CanonicalizationMethod parameters. An attacker could use this
flaw to spoof XML signatures.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
libxml-security-java 1.4.3-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2028-1
CVE-2013-2172
Package Information:
https://launchpad.net/ubuntu/+source/libxml-security-java/1.4.3-2ubuntu0.1
No comments:
Post a Comment