pool/libxml2
SHA256
20
0
Fork 3
Code Issues Pull Requests Activity

checkin

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libxml2?expand=0&rev=244
This commit is contained in:
Petr Gajdos
2025-06-18 08:10:06 +00:00
committed by Git OBS Bridge
parent e8a016bd83
commit 4fa301fa17
3 changed files with 63 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libxml2.changes
+18
View File
@@ -1,3 +1,21 @@
-------------------------------------------------------------------
Wed Jun 18 08:08:55 UTC 2025 - pgajdos@suse.com
- security update
- added patches
CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
+ libxml2-CVE-2025-6170.patch
-------------------------------------------------------------------
Tue Jun 17 09:59:23 UTC 2025 - pgajdos@suse.com
- disable schematron code
https://gitlab.gnome.org/GNOME/libxml2/-/issues/931
https://gitlab.gnome.org/GNOME/libxml2/-/issues/932
https://gitlab.gnome.org/GNOME/libxml2/-/issues/933
- mitigates CVE-2025-49794 [bsc#1244554], CVE-2025-49795
[bsc#1244555] and CVE-2025-49796 [bsc#1244557]
-------------------------------------------------------------------
Thu Apr 17 17:14:42 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
libxml2.spec
+4 -1
View File
@@ -54,6 +54,8 @@ Patch1: libxml2-python3-string-null-check.patch
## SUSE-specific? If so, shouldn't it be applied only for SLE distributions?
# PATCH-FIX-SUSE bsc#1135123 Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH to avoid nodeset limit
Patch2000: libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
# CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
Patch2001: libxml2-CVE-2025-6170.patch
#
BuildRequires: fdupes
BuildRequires: pkgconfig
@@ -176,7 +178,8 @@ export CFLAGS="%{optflags} -fno-strict-aliasing"
--with-reader \
--with-ftp \
--with-http \
--with-legacy
--with-legacy \
--with-schematron=no
%make_build BASE_DIR="%{_docdir}" DOC_MODULE="%{base_name}"
%else
libxml2-CVE-2025-6170.patch
+41
View File
@@ -0,0 +1,41 @@
From acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Tue, 27 May 2025 12:53:17 +0200
Subject: [PATCH] tree: Fix integer overflow in xmlBuildQName
This issue affects memory safety and might receive a CVE ID later.
Fixes #926.
---
tree.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
Index: libxml2-2.13.8/tree.c
===================================================================
--- libxml2-2.13.8.orig/tree.c
+++ libxml2-2.13.8/tree.c
@@ -167,10 +167,10 @@ xmlGetParameterEntityFromDtd(const xmlDt
xmlChar *
xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
xmlChar *memory, int len) {
- int lenn, lenp;
+ size_t lenn, lenp;
xmlChar *ret;
- if (ncname == NULL) return(NULL);
+ if ((ncname == NULL) || (len < 0)) return(NULL);
if (prefix == NULL) return((xmlChar *) ncname);
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
@@ -181,8 +181,10 @@ xmlBuildQName(const xmlChar *ncname, con
lenn = strlen((char *) ncname);
lenp = strlen((char *) prefix);
+ if (lenn >= SIZE_MAX - lenp - 1)
+ return(NULL);
- if ((memory == NULL) || (len < lenn + lenp + 2)) {
+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
if (ret == NULL)
return(NULL);