From: Siddharth Doshi <[email protected]> Analysis: - The patch adds return NULL guard when xmlStrlen returns 0. [1] - However, in libxml2-2.10.12, an older iteration of the guard clause is present, which was removed in future versions and then added back as patch via CVE-2026-86139. - Hence, adding the patch as fixed-version.
Reference: [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139 Signed-off-by: Siddharth Doshi <[email protected]> --- meta/recipes-core/libxml/libxml2_2.12.10.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 28ae601118..581f38197f 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -46,6 +46,9 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail # https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided. https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"; +#The codebase contains an older iteration of the guard clause if (!(len > 0)) return(NULL); which inherently mitigates the len == 0 attack vector described in CVE-2026-86139. +CVE_STATUS[CVE-2026-86139] = "fixed-version: Length guard safety logic natively present in version 2.12.10 protects against zero-length integer overflows." + BINCONFIG = "${bindir}/xml2-config" PACKAGECONFIG ??= "python \ -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245595): https://lists.openembedded.org/g/openembedded-core/message/245595 Mute This Topic: https://lists.openembedded.org/mt/121187741/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
