tetromino 14/05/08 15:40:25 Added: libxml2-2.9.1-external-param-entities.patch Log: Fix denial of service vulnerability (CVE-2014-0191, bug #509834, thanks to Agostino Sarubbo). Enable support for Python 3.4. Modernize python build as suggested by Michał Górny. (Portage version: 2.2.10/cvs/Linux x86_64, signed Manifest commit with key CF0ADD61)
Revision Changes Path 1.1 dev-libs/libxml2/files/libxml2-2.9.1-external-param-entities.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.9.1-external-param-entities.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/libxml2/files/libxml2-2.9.1-external-param-entities.patch?rev=1.1&content-type=text/plain Index: libxml2-2.9.1-external-param-entities.patch =================================================================== >From 9cd1c3cfbd32655d60572c0a413e017260c854df Mon Sep 17 00:00:00 2001 From: Daniel Veillard <[email protected]> Date: Tue, 22 Apr 2014 15:30:56 +0800 Subject: [PATCH] Do not fetch external parameter entities Unless explicitely asked for when validating or replacing entities with their value. Problem pointed out by Daniel Berrange <[email protected]> --- parser.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/parser.c b/parser.c index 9347ac9..c0dea05 100644 --- a/parser.c +++ b/parser.c @@ -2598,6 +2598,20 @@ xmlParserHandlePEReference(xmlParserCtxtPtr ctxt) { xmlCharEncoding enc; /* + * Note: external parsed entities will not be loaded, it is + * not required for a non-validating parser, unless the + * option of validating, or substituting entities were + * given. Doing so is far more secure as the parser will + * only process data coming from the document entity by + * default. + */ + if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && + ((ctxt->options & XML_PARSE_NOENT) == 0) && + ((ctxt->options & XML_PARSE_DTDVALID) == 0) && + (ctxt->validate == 0)) + return; + + /* * handle the extra spaces added before and after * c.f. http://www.w3.org/TR/REC-xml#as-PE * this is done independently. -- 1.9.2
