Mageia alert MGASA-2016-0101 (exempi exiv2)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0101: Updated exempi exiv2 packages fix security vulnerability 
Date:
    	     
 
Mon, 7 Mar 2016 20:59:22 +0100
Message-ID:
    	     
 
<20160307195922.E86509F6E3@duvel.mageia.org>
MGASA-2016-0101 - Updated exempi exiv2 packages fix security vulnerability

Publication date: 07 Mar 2016
URL: http://advisories.mageia.org/MGASA-2016-0101.html
Type: security
Affected Mageia releases: 5

Description:
exempi contains code to protect against a denial-service-attack
related to XML entity expansion ("billion laughs attack"), but it was
not compiled into the Mageia package because BanAllEntityUsage was not
defined when the package was compiled.

This has been corrected by recompiling it with the BanAllEntityUsage
macro defined. The exiv2 package contains a bundled copy of the same
code and has also been recompiled with the macro defined.

References:
- https://bugs.mageia.org/show_bug.cgi?id=17877
- https://lists.fedoraproject.org/pipermail/package-announc...

SRPMS:
- 5/core/exempi-2.2.2-14.1.mga5
- 5/core/exiv2-0.24-5.1.mga5