Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xmlrpc-c for openSUSE:Factory checked in at 2026-07-29 19:01:42 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xmlrpc-c (Old) and /work/SRC/openSUSE:Factory/.xmlrpc-c.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xmlrpc-c" Wed Jul 29 19:01:42 2026 rev:16 rq:1368370 version:1.64.03 Changes: -------- --- /work/SRC/openSUSE:Factory/xmlrpc-c/xmlrpc-c.changes 2026-06-22 17:29:52.518656892 +0200 +++ /work/SRC/openSUSE:Factory/.xmlrpc-c.new.2004/xmlrpc-c.changes 2026-07-29 19:02:59.449385523 +0200 @@ -1,0 +2,6 @@ +Wed Jul 29 10:54:28 UTC 2026 - Samuel Cabrero <[email protected]> + +- Fix HTML injection; CVE-2026-15928; bsc#1272769; Add patch + 0002-CVE-2026-15928-HTML-injection.patch + +------------------------------------------------------------------- New: ---- 0002-CVE-2026-15928-HTML-injection.patch ----------(New B)---------- New:- Fix HTML injection; CVE-2026-15928; bsc#1272769; Add patch 0002-CVE-2026-15928-HTML-injection.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xmlrpc-c.spec ++++++ --- /var/tmp/diff_new_pack.7GnClY/_old 2026-07-29 19:03:00.085407443 +0200 +++ /var/tmp/diff_new_pack.7GnClY/_new 2026-07-29 19:03:00.089407580 +0200 @@ -29,6 +29,7 @@ Source: https://downloads.sourceforge.net/xmlrpc-c/xmlrpc-%{version}.tgz Source9: %{name}-rpmlintrc Patch1: skip-expat.patch +Patch2: 0002-CVE-2026-15928-HTML-injection.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: gcc-c++ ++++++ 0002-CVE-2026-15928-HTML-injection.patch ++++++ diff -ruN xmlrpc-1.64.03.orig/lib/abyss/src/handler.c xmlrpc-1.64.03/lib/abyss/src/handler.c --- xmlrpc-1.64.03.orig/lib/abyss/src/handler.c 2024-12-26 19:24:08.000000000 +0100 +++ xmlrpc-1.64.03/lib/abyss/src/handler.c 2026-07-29 13:58:55.313839267 +0200 @@ -36,6 +36,7 @@ #include "file.h" #include "conn.h" #include "http.h" +#include "html.h" #include "date.h" #include "abyss_info.h" @@ -291,11 +292,15 @@ "------------------------------------" "--------------------------------------------\r\n"); } else { + const char * const escapedUri = html_escapedForHtml(uri); + sprintf(z, "<HTML><HEAD><TITLE>Index of %s</TITLE></HEAD><BODY>" "<H1>Index of %s</H1><PRE>", - uri, uri); + escapedUri, escapedUri); strcat(z, "Name Size " "Date-Time Type<HR WIDTH=100%>\r\n"); + + xmlrpc_strfree(escapedUri); } HTTPWriteBodyChunk(sessionP, z, strlen(z)); @@ -304,6 +309,37 @@ static void +formatHtmlForDirEntry(char * const buffer, + const char * const name, + int const attrib, + const char * const z1, + const char * const z2, + const char * const z3, + const char * const z4, + const char * const p) { + + const char * const escapedName = html_escapedForHtml(name); + const char * const escapedZ1 = html_escapedForHtml(z1); + const char * const escapedZ2 = html_escapedForHtml(z2); + const char * const escapedZ3 = html_escapedForHtml(z3); + const char * const escapedZ4 = html_escapedForHtml(z4); + const char * const escapedP = html_escapedForHtml(p); + + sprintf(buffer, "<A HREF=\"%s%s\">%s</A>%s %s %s %s\r\n", + escapedName, attrib & A_SUBDIR ? "/" : "", + escapedZ1, escapedP, escapedZ3, escapedZ2, escapedZ4); + + xmlrpc_strfree(escapedP); + xmlrpc_strfree(escapedZ1); + xmlrpc_strfree(escapedZ2); + xmlrpc_strfree(escapedZ3); + xmlrpc_strfree(escapedZ4); + xmlrpc_strfree(escapedName); +} + + + +static void sendDirectoryDocument(TList * const listP, bool const ascending, uint16_t const sort, @@ -405,9 +441,7 @@ if (text) sprintf(z, "%s%s %s %s %s\r\n", z1, p, z3, z2, z4); else - sprintf(z, "<A HREF=\"%s%s\">%s</A>%s %s %s %s\r\n", - fi->name, fi->attrib & A_SUBDIR ? "/" : "", - z1, p, z3, z2, z4); + formatHtmlForDirEntry(z, fi->name, fi->attrib, z1, z2, z3, z4, p); HTTPWriteBodyChunk(sessionP, z, strlen(z)); } diff -ruN xmlrpc-1.64.03.orig/lib/abyss/src/html.c xmlrpc-1.64.03/lib/abyss/src/html.c --- xmlrpc-1.64.03.orig/lib/abyss/src/html.c 1970-01-01 01:00:00.000000000 +0100 +++ xmlrpc-1.64.03/lib/abyss/src/html.c 2026-07-29 13:58:55.314406656 +0200 @@ -0,0 +1,89 @@ +/*============================================================================= + html +=============================================================================== + This module contains utilities for processing HTML. +=============================================================================*/ + +#include <assert.h> +#include <stdlib.h> + +#include <xmlrpc-c/string_int.h> + +#include "html.h" + + + +static void +insertCharEntity(char * const buffer, + unsigned int * const cursorP, + const char * const name) { + + size_t i; + + buffer[(*cursorP)++] = '&'; + + for (i = 0; i < strlen(name); ++i) + buffer[(*cursorP)++] = name[i]; + + buffer[(*cursorP)++] = ';'; +} + + + +const char * +html_escapedForHtml(const char * const plainText) { +/*---------------------------------------------------------------------------- + The text 'plainText' with HTML control characters replaced with + HTML character entities so that the result can be used inside an HTML + document without any chance of interfering with HTML controls. + + In particular, we substitute one of the following for each associated + character: + + & + < + > + " + ' + + We return newly malloced storage or a constant if we can't get allocate + enough, like 'xmlrpc_strdupsol', which must be freed with 'xmlrpc_strfree'. +-----------------------------------------------------------------------------*/ + + size_t const maxPossibleReturnSz = strlen(plainText) * 6 + 1; + + const char * retval; + char * buffer; /* malloc'ed */ + + buffer = malloc(maxPossibleReturnSz); + + if (!buffer) + retval = xmlrpc_strnomemval(); + else { + unsigned int inCursor, outCursor; + + for (inCursor = 0, outCursor = 0; + inCursor < strlen(plainText); + ++inCursor) { + + switch (plainText[inCursor]) { + case '&': insertCharEntity(buffer, &outCursor, "amp"); break; + case '<': insertCharEntity(buffer, &outCursor, "lt"); break; + case '>': insertCharEntity(buffer, &outCursor, "gt"); break; + case '"': insertCharEntity(buffer, &outCursor, "quot"); break; + case '\'': insertCharEntity(buffer, &outCursor, "apos"); break; + default: + buffer[outCursor++] = plainText[inCursor]; + } + } + + buffer[outCursor++] = '\0'; /* string-terminating NUL */ + + assert(outCursor <= maxPossibleReturnSz); + + retval = buffer; + } + return retval; +} + + diff -ruN xmlrpc-1.64.03.orig/lib/abyss/src/html.h xmlrpc-1.64.03/lib/abyss/src/html.h --- xmlrpc-1.64.03.orig/lib/abyss/src/html.h 1970-01-01 01:00:00.000000000 +0100 +++ xmlrpc-1.64.03/lib/abyss/src/html.h 2026-07-29 13:58:55.314504715 +0200 @@ -0,0 +1,7 @@ +#ifndef HTML_H_INCLUDED +#define HTML_H_INCLUDED + +const char * +html_escapedForHtml(const char * const plainText); + +#endif diff -ruN xmlrpc-1.64.03.orig/lib/abyss/src/Makefile xmlrpc-1.64.03/lib/abyss/src/Makefile --- xmlrpc-1.64.03.orig/lib/abyss/src/Makefile 2025-12-25 04:19:23.000000000 +0100 +++ xmlrpc-1.64.03/lib/abyss/src/Makefile 2026-07-29 13:58:55.314586482 +0200 @@ -45,6 +45,7 @@ date \ file \ handler \ + html \ http \ init \ response \ diff -ruN xmlrpc-1.64.03.orig/lib/abyss/src/response.c xmlrpc-1.64.03/lib/abyss/src/response.c --- xmlrpc-1.64.03.orig/lib/abyss/src/response.c 2024-12-26 19:24:08.000000000 +0100 +++ xmlrpc-1.64.03/lib/abyss/src/response.c 2026-07-29 14:00:10.248073524 +0200 @@ -34,6 +34,7 @@ #include "data.h" #include "abyss_info.h" #include "http.h" +#include "html.h" @@ -41,6 +42,8 @@ ResponseError2(TSession * const sessionP, const char * const explanation) { + const char * const escapedExplanation = html_escapedForHtml(explanation); + const char * errorDocument; ResponseAddField(sessionP, "Content-type", "text/html"); @@ -54,12 +57,14 @@ "<P>%s</P>" SERVER_HTML_INFO "</BODY>" "</HTML>", - sessionP->status, sessionP->status, explanation); + sessionP->status, sessionP->status, escapedExplanation); ConnWrite(sessionP->connP, errorDocument, strlen(errorDocument), CONN_EXPECT_NOTHING); xmlrpc_strfree(errorDocument); + + xmlrpc_strfree(escapedExplanation); } diff -ruN xmlrpc-1.64.03.orig/src/abyss_handler.c xmlrpc-1.64.03/src/abyss_handler.c --- xmlrpc-1.64.03.orig/src/abyss_handler.c 2023-12-26 20:30:28.000000000 +0100 +++ xmlrpc-1.64.03/src/abyss_handler.c 2026-07-29 13:58:55.315104754 +0200 @@ -611,7 +611,7 @@ abyss_bool xmlrpc_serverAbyssDefaultUriHandler(TSession * const sessionP) { /*---------------------------------------------------------------------------- - This is an Abyss default handler. It return a 404 Not Found for all + This is an Abyss default handler. It returns a 404 Not Found for all requests. -----------------------------------------------------------------------------*/ const TRequestInfo * requestInfoP; diff -ruN xmlrpc-1.64.03.orig/src/xmlrpc_serialize.c xmlrpc-1.64.03/src/xmlrpc_serialize.c --- xmlrpc-1.64.03.orig/src/xmlrpc_serialize.c 2023-12-26 20:30:28.000000000 +0100 +++ xmlrpc-1.64.03/src/xmlrpc_serialize.c 2026-07-29 13:58:55.315355599 +0200 @@ -157,11 +157,10 @@ 
 is known in XML as a "character reference." - We assume chars[] is is ASCII. That isn't right -- we should - handle all valid UTF-8. Someday, we must do something more complex - and copy over multibyte characters verbatim. (The code here could - erroneously find that e.g. the 2nd byte of a UTF-8 character is a - CR). + We assume chars[] is ASCII. That isn't right -- we should handle all valid + UTF-8. Someday, we must do something more complex and copy over multibyte + characters verbatim. (The code here could erroneously find that e.g. the + 2nd byte of a UTF-8 character is a CR). -----------------------------------------------------------------------------*/ xmlrpc_mem_block * outputP; size_t outputSize;
