------------------------------------------------------------------------
Pardus Linux Security Advisory 2009-181           security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2009-11-14
  Severity: 3
      Type: Local
------------------------------------------------------------------------

Summary
======
A vulnerability have been found in PyXML package, which can be used  by
malicious people to cause denial of service via infinite loop.

[UPDATE] Same issue was fixed in Pardus 2008


Description
==========
The issue is similar to #10990. PyXML uses unpatched expat code which is
prone to denial of service attack via malformed UTF-8 xml entries.


Affected packages:

  Pardus 2009:
    PyXML, all before 0.8.4-4-3
  Pardus 2008:
    PyXML, all before 0.8.4-4-3


Resolution
=========
There are update(s) for PyXML. You can update them via Package  Manager
or with a single command from console:

  Pardus 2008:
    pisi up PyXML

  Pardus 2009:
    pisi up PyXML


References
=========
  * http://bugs.pardus.org.tr/show_bug.cgi?id477
  * http://bugs.pardus.org.tr/show_bug.cgi?id990
  * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720