Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package libxslt for openSUSE:Factory checked
in at 2025-07-20 15:28:16
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libxslt (Old)
and /work/SRC/openSUSE:Factory/.libxslt.new.8875 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libxslt"
Sun Jul 20 15:28:16 2025 rev:73 rq:1294383 version:1.1.43
Changes:
--------
--- /work/SRC/openSUSE:Factory/libxslt/libxslt.changes 2025-03-15
16:15:11.829841247 +0100
+++ /work/SRC/openSUSE:Factory/.libxslt.new.8875/libxslt.changes
2025-07-20 15:28:39.671049377 +0200
@@ -1,0 +2,8 @@
+Thu Jul 17 09:44:34 UTC 2025 - pgaj...@suse.com
+
+- security update
+- added patches
+ CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between
stylesheet and source nodes
+ + libxslt-CVE-2025-7424.patch
+
+-------------------------------------------------------------------
New:
----
libxslt-CVE-2025-7424.patch
----------(New B)----------
New: CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between
stylesheet and source nodes
+ libxslt-CVE-2025-7424.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ libxslt.spec ++++++
--- /var/tmp/diff_new_pack.x7jfh8/_old 2025-07-20 15:28:40.355077682 +0200
+++ /var/tmp/diff_new_pack.x7jfh8/_new 2025-07-20 15:28:40.359077848 +0200
@@ -40,11 +40,8 @@
# Initialize the random seed to ensure libxslt's math.random() function
# produces unpredictable outputs.
Patch1: libxslt-random-seed.patch
-#
-### SUSE patches starts on 1000
-# PATCH-FIX-SUSE
-#Patch1000:
-#
+# CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between
stylesheet and source nodes
+Patch2: libxslt-CVE-2025-7424.patch
BuildRequires: fdupes
BuildRequires: gcc
BuildRequires: libgcrypt-devel
++++++ libxslt-CVE-2025-7424.patch ++++++
>From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
From: David Kilzer <ddkil...@apple.com>
Date: Sat, 24 May 2025 15:06:42 -0700
Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
and source nodes
* libxslt/functions.c:
(xsltDocumentFunctionLoadDocument):
- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
xmlDoc to tctxt->docList.
- Add error handling for functions that may return NULL.
* libxslt/transform.c:
- Remove static keyword so this can be called from
xsltDocumentFunctionLoadDocument().
* libxslt/transformInternals.h: Add.
(xsltCleanupSourceDoc): Add declaration.
Fixes #139.
---
libxslt/functions.c | 16 +++++++++++++++-
libxslt/transform.c | 3 ++-
libxslt/transformInternals.h | 9 +++++++++
3 files changed, 26 insertions(+), 2 deletions(-)
create mode 100644 libxslt/transformInternals.h
diff --git a/libxslt/functions.c b/libxslt/functions.c
index 72a58dc4..11ec039f 100644
--- a/libxslt/functions.c
+++ b/libxslt/functions.c
@@ -34,6 +34,7 @@
#include "numbersInternals.h"
#include "keys.h"
#include "documents.h"
+#include "transformInternals.h"
#ifdef WITH_XSLT_DEBUG
#define WITH_XSLT_DEBUG_FUNCTION
@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr
ctxt,
/*
* This selects the stylesheet's doc itself.
*/
- doc = tctxt->style->doc;
+ doc = xmlCopyDoc(tctxt->style->doc, 1);
+ if (doc == NULL) {
+ xsltTransformError(tctxt, NULL, NULL,
+ "document() : failed to copy style doc\n");
+ goto out_fragment;
+ }
+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
+ idoc = xsltNewDocument(tctxt, doc);
+ if (idoc == NULL) {
+ xsltTransformError(tctxt, NULL, NULL,
+ "document() : failed to create xsltDocument\n");
+ xmlFreeDoc(doc);
+ goto out_fragment;
+ }
} else {
goto out_fragment;
}
diff --git a/libxslt/transform.c b/libxslt/transform.c
index 54ef821b..38c2dce6 100644
--- a/libxslt/transform.c
+++ b/libxslt/transform.c
@@ -43,6 +43,7 @@
#include "xsltlocale.h"
#include "pattern.h"
#include "transform.h"
+#include "transformInternals.h"
#include "variables.h"
#include "numbersInternals.h"
#include "namespaces.h"
@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
*
* Resets source node flags and ids stored in 'psvi' member.
*/
-static void
+void
xsltCleanupSourceDoc(xmlDocPtr doc) {
xmlNodePtr cur = (xmlNodePtr) doc;
void **psviPtr;
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
new file mode 100644
index 00000000..d0f42823
--- /dev/null
+++ b/libxslt/transformInternals.h
@@ -0,0 +1,9 @@
+/*
+ * Summary: set of internal interfaces for the XSLT engine transformation part.
+ *
+ * Copy: See Copyright for the status of this software.
+ *
+ * Author: David Kilzer <ddkil...@apple.com>
+ */
+
+void xsltCleanupSourceDoc(xmlDocPtr doc);
--
2.39.5 (Apple Git-154)
