File _patchinfo of Package patchinfo.8634

<patchinfo incident="8634">
  <issue tracker="bnc" id="1088279">VUL-1: CVE-2018-9251: libxml2: The xz_decomp function in xzlib.c allows remote attackers to cause a denial of service (infinite loop) via acrafted XML file that triggers LZMA_MEMLIMIT_ERROR</issue>
  <issue tracker="bnc" id="1102046">VUL-1: CVE-2018-14404 libxml2: NULL pointer dereference in xpath.c:xmlXPathCompOpEval() can allow attackers to cause a denial of service</issue>
  <issue tracker="bnc" id="1105166">VUL-0: CVE-2018-14567: libxml2: infinite loop in LZMA decompression</issue>
  <issue tracker="cve" id="2018-9251"/>
  <issue tracker="cve" id="2018-14567"/>
  <issue tracker="cve" id="2018-14404"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>pmonrealgonzalez</packager>
  <description>This update for libxml2 fixes the following security issues:

- CVE-2018-9251: The xz_decomp function allowed remote attackers to cause a
  denial of service (infinite loop) via a crafted XML file that triggers
  LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint (bsc#1088279)
- CVE-2018-14567: Prevent denial of service (infinite loop) via a crafted XML
  file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint
  (bsc#1105166)
- CVE-2018-14404: Prevent NULL pointer dereference in the xmlXPathCompOpEval()
  function when parsing an invalid XPath expression in the XPATH_OP_AND or
  XPATH_OP_OR case leading to a denial of service attack (bsc#1102046)
</description>
  <summary>Security update for libxml2</summary>
</patchinfo>