Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libxml2* to *2.15.4* has Succeeded.
Next steps:
- apply the patch: git am 0001-libxml2-upgrade-2.15.3-2.15.4.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
>From a09ca2ffaba825830a3dbca8f0a01f24535474cb Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Sat, 5 Sep 2026 05:20:55 +0000
Subject: [PATCH] libxml2: upgrade 2.15.3 -> 2.15.4
Source: NEWS
v2.15.4: Sep 01 2026
### Security
- xmlregexp: Prevent out-of-bounds read in NXT macro
- fix: add missing overflow checks in dict.c, uri.c, and valid.c
- xmlregexp: Calc string length after null checking
- xpointer: Check overflow in xmlXPtrEvalXPtrPart
- xmlIO: Check for int overflow before calling writecallback
- fix(xinclude): propagate parseFlags in xmlXIncludeProcess and
xmlXIncludeProcessTree
### Improvements
- Improve bound checks for xmlcatalog and xmllint arguments (out-of-bound)
- Fix memory leak in static Windows library (memory-leak)
- xmlreader: Copy DTD in xmlTextReaderDumpCopy
- parser: Fix double free in xmlIOParseDTD (double-free)
- parser: fix division-by-zero when maxAmpl is set to 0
- parser: Fix memory leak in xmlCtxtSetSaxHandler (memory-leak)
- catalog: Make sure to reset catalog resolve cache
- xmlAddChild: unlink node before free for text nodes (memory-leak)
- Normalize entity values in attr in xmlNodeGetContent
- Handle whitespace for date/time/duration types
- catalog: Fix NULL deref for nextCatalog without 'catalog' attribute
(null-deref)
### Thanks
Thanks to the following new contributors:
- Brett Kail
- Ion Nistor
- Kevin Braun
- Mohammad Seet
- rootvector2
- Ruben Thijssen
- yirou_yang
- Zhihan Zheng
- zhuofeng
### Full list of commits and contributors on this release
13 Daniel Garcia Moreno
8 Mohammad Seet
6 zhuofeng
2 Benjamin Gilbert
1 Brett Kail
1 Hieu Le Minh
1 Ion Nistor
1 Kevin Braun
1 Nick Wellnhofer
1 Ruben Thijssen
1 Zhihan Zheng
1 rootvector2
1 yirou_yang
---
...-installation-directories-in-libxml2.patch | 6 +-
.../libxml/libxml2/CVE-2026-11979.patch | 81 -------------------
.../libxml/libxml2/install-tests.patch | 2 +-
.../{libxml2_2.15.3.bb => libxml2_2.15.4.bb} | 3 +-
4 files changed, 5 insertions(+), 87 deletions(-)
delete mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
rename meta/recipes-core/libxml/{libxml2_2.15.3.bb => libxml2_2.15.4.bb} (96%)
diff --git
a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
index d19b284866..a1d24b596e 100644
---
a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
+++
b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch
@@ -1,4 +1,4 @@
-From 803e6f21d3d7ef6399f6ffe58cd28fa6dc7b94e9 Mon Sep 17 00:00:00 2001
+From aa31b72c260de3f15289db8d78c9674b0cf55f7f Mon Sep 17 00:00:00 2001
From: Peter Marko <[email protected]>
Date: Mon, 26 May 2025 21:11:14 +0200
Subject: [PATCH] Revert "cmake: Fix installation directories in
@@ -66,10 +66,10 @@ index ff6433f..b775cfe 100644
set(LIBXML2_LIBRARIES ${LIBXML2_LIBRARY})
set(LIBXML2_INCLUDE_DIRS ${LIBXML2_INCLUDE_DIR})
diff --git a/meson.build b/meson.build
-index 2cfecb6..f78da31 100644
+index f8337ea..19fdbb0 100644
--- a/meson.build
+++ b/meson.build
-@@ -593,9 +593,6 @@ config_cmake = configuration_data()
+@@ -594,9 +594,6 @@ config_cmake = configuration_data()
config_cmake.set('LIBXML_MAJOR_VERSION', v_maj)
config_cmake.set('LIBXML_MINOR_VERSION', v_min)
config_cmake.set('LIBXML_MICRO_VERSION', v_mic)
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
b/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
deleted file mode 100644
index a14e566681..0000000000
--- a/meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From dfad0660f7dab3b5f8317b703b16ad0b0d12697d Mon Sep 17 00:00:00 2001
-From: Daniel Garcia Moreno <[email protected]>
-Date: Fri, 22 May 2026 12:21:20 +0200
-Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
-
-Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
-
-CVE: CVE-2026-11979
-Signed-off-by: Anton Skorup <[email protected]>
-Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e]
----
- test/catalogs/test.sh | 11 +++++++++++
- xmlcatalog.c | 16 ++++++++++++++++
- 2 files changed, 27 insertions(+)
-
-diff --git a/test/catalogs/test.sh b/test/catalogs/test.sh
-index 7e5eaa76..84e8b90a 100755
---- a/test/catalogs/test.sh
-+++ b/test/catalogs/test.sh
-@@ -10,6 +10,17 @@ fi
-
- exitcode=0
-
-+# Test xmlcatalog --shell command line
-+# Case 1: Really long argument (470 chars)
-+input=""; for i in {1..470}; do input="${input}A"; done
-+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
-+# Case 2: public + long argument
-+input="public "; for i in {1..470}; do input="${input}A"; done
-+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
-+# Case 3: public + lots of args
-+input="public "; for i in {1..80}; do input="${input} x"; done
-+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
-+
- for i in test/catalogs/*.script ; do
- name=$(basename $i .script)
- xml="./test/catalogs/$name.xml"
-diff --git a/xmlcatalog.c b/xmlcatalog.c
-index b400c7cb..5113e930 100644
---- a/xmlcatalog.c
-+++ b/xmlcatalog.c
-@@ -135,6 +135,12 @@ static void usershell(void) {
- (*cur != '\n') && (*cur != '\r')) {
- if (*cur == 0)
- break;
-+ /* Do not read beyond the command array capacity */
-+ if (i >= (int)sizeof(command) - 2) {
-+ printf("Invalid command %s\n", cur);
-+ i = 0;
-+ break;
-+ }
- command[i++] = *cur++;
- }
- command[i] = 0;
-@@ -152,6 +158,11 @@ static void usershell(void) {
- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
- if (*cur == 0)
- break;
-+ if (i >= (int)sizeof(arg) - 2) {
-+ printf("Invalid arg %s\n", arg);
-+ i = 0;
-+ break;
-+ }
- arg[i++] = *cur++;
- }
- arg[i] = 0;
-@@ -164,6 +175,11 @@ static void usershell(void) {
- cur = arg;
- memset(argv, 0, sizeof(argv));
- while (*cur != 0) {
-+ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
-+ printf("Too much arguments\n");
-+ break;
-+ }
-+
- while ((*cur == ' ') || (*cur == '\t')) cur++;
- if (*cur == '\'') {
- cur++;
---
-2.43.0
-
diff --git a/meta/recipes-core/libxml/libxml2/install-tests.patch
b/meta/recipes-core/libxml/libxml2/install-tests.patch
index 996ade614e..55559b7df3 100644
--- a/meta/recipes-core/libxml/libxml2/install-tests.patch
+++ b/meta/recipes-core/libxml/libxml2/install-tests.patch
@@ -1,4 +1,4 @@
-From c6b547e06beb0f0ba99e30d036f055eaed9ec4dc Mon Sep 17 00:00:00 2001
+From 11159757ae9ff484e02764b36cef970b3d0178c2 Mon Sep 17 00:00:00 2001
From: Ross Burton <[email protected]>
Date: Fri, 17 Oct 2025 14:15:36 +0800
Subject: [PATCH] add yocto-specific install-ptest target
diff --git a/meta/recipes-core/libxml/libxml2_2.15.3.bb
b/meta/recipes-core/libxml/libxml2_2.15.4.bb
similarity index 96%
rename from meta/recipes-core/libxml/libxml2_2.15.3.bb
rename to meta/recipes-core/libxml/libxml2_2.15.4.bb
index 8b0ba29412..99f3b9675a 100644
--- a/meta/recipes-core/libxml/libxml2_2.15.3.bb
+++ b/meta/recipes-core/libxml/libxml2_2.15.4.bb
@@ -18,10 +18,9 @@ SRC_URI +=
"http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://run-ptest \
file://install-tests.patch \
file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch \
- file://CVE-2026-11979.patch \
"
-SRC_URI[archive.sha256sum] =
"78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4a9a9a5042c7a07"
+SRC_URI[archive.sha256sum] =
"98087fd181d9070724f3fbc65c7377db03038eb92bd882374daff44940138821"
SRC_URI[testtar.sha256sum] =
"c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273"
CVE_STATUS[CVE-2025-6170] = "fixed-version: fixed in version 2.14.5"
--
2.47.1
0001-libxml2-upgrade-2.15.3-2.15.4.patch
Description: Binary data
Changelog for libxml2: 2.15.3 -> 2.15.4 Source: NEWS v2.15.4: Sep 01 2026 ### Security - xmlregexp: Prevent out-of-bounds read in NXT macro - fix: add missing overflow checks in dict.c, uri.c, and valid.c - xmlregexp: Calc string length after null checking - xpointer: Check overflow in xmlXPtrEvalXPtrPart - xmlIO: Check for int overflow before calling writecallback - fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree ### Improvements - Improve bound checks for xmlcatalog and xmllint arguments (out-of-bound) - Fix memory leak in static Windows library (memory-leak) - xmlreader: Copy DTD in xmlTextReaderDumpCopy - parser: Fix double free in xmlIOParseDTD (double-free) - parser: fix division-by-zero when maxAmpl is set to 0 - parser: Fix memory leak in xmlCtxtSetSaxHandler (memory-leak) - catalog: Make sure to reset catalog resolve cache - xmlAddChild: unlink node before free for text nodes (memory-leak) - Normalize entity values in attr in xmlNodeGetContent - Handle whitespace for date/time/duration types - catalog: Fix NULL deref for nextCatalog without 'catalog' attribute (null-deref) ### Thanks Thanks to the following new contributors: - Brett Kail - Ion Nistor - Kevin Braun - Mohammad Seet - rootvector2 - Ruben Thijssen - yirou_yang - Zhihan Zheng - zhuofeng ### Full list of commits and contributors on this release 13 Daniel Garcia Moreno 8 Mohammad Seet 6 zhuofeng 2 Benjamin Gilbert 1 Brett Kail 1 Hieu Le Minh 1 Ion Nistor 1 Kevin Braun 1 Nick Wellnhofer 1 Ruben Thijssen 1 Zhihan Zheng 1 rootvector2 1 yirou_yang
packages/x86-64-v3-poky-linux/libxml2: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2: SRC_URI changed from "https://download.gnome.org/sources//libxml2/2.15/libxml2-2.15.3.tar.xz;name=archive http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=libxml2-2.15.3;name=testtar file://run-ptest file://install-tests.patch file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch file://CVE-2026-11979.patch" to "https://download.gnome.org/sources//libxml2/2.15/libxml2-2.15.4.tar.xz;name=archive http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=libxml2-2.15.4;name=testtar file://run-ptest file://install-tests.patch file://0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch" packages/x86-64-v3-poky-linux/libxml2: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-dbg: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-dbg: FILELIST: removed "/usr/lib/.debug/libxml2.so.16.1.3", added "/usr/lib/.debug/libxml2.so.16.1.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-dbg: PKGSIZE changed from 5119504 to 5134088 (+0%) packages/x86-64-v3-poky-linux/libxml2/libxml2-dbg: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-dev: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-dev: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-doc: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-doc: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-locale: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-locale: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-ptest: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-ptest: FILELIST: added "/usr/lib/libxml2/ptest/test/XInclude/issue1120/issue1120-2.xml /usr/lib/libxml2/ptest/result/XInclude/issue1120-2.xml.err /usr/lib/libxml2/ptest/result/XInclude/issue1120-1.xml.err /usr/lib/libxml2/ptest/result/XInclude/issue1120-2.xml /usr/lib/libxml2/ptest/result/XInclude/issue1120-1.xml /usr/lib/libxml2/ptest/test/schemas/date-whitespace_0.xml /usr/lib/libxml2/ptest/test/schemas/date-whitespace_1.xml /usr/lib/libxml2/ptest/result/schemas/date-whitespace_0_1.err /usr/lib/libxml2/ptest/test/catalogs/next-catalog-missing-attr.xml /usr/lib/libxml2/ptest/test/XInclude/issue1120/issue1120-1.xml /usr/lib/libxml2/ptest/test/schemas/date-whitespace_0.xsd /usr/lib/libxml2/ptest/result/schemas/date-whitespace_0_0.err" packages/x86-64-v3-poky-linux/libxml2/libxml2-ptest: PKGSIZE changed from 16406007 to 16422924 (+0%) packages/x86-64-v3-poky-linux/libxml2/libxml2-ptest: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-src: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-src: FILELIST: directory renamed /usr/src/debug/libxml2/2.15.3/include/libxml -> /usr/src/debug/libxml2/2.15.4/include/libxml, directory renamed /usr/src/debug/libxml2/2.15.3/codegen -> /usr/src/debug/libxml2/2.15.4/codegen, directory renamed /usr/src/debug/libxml2/2.15.3 -> /usr/src/debug/libxml2/2.15.4, directory renamed /usr/src/debug/libxml2/2.15.3/include/private -> /usr/src/debug/libxml2/2.15.4/include/private packages/x86-64-v3-poky-linux/libxml2/libxml2-src: PKGSIZE changed from 5508800 to 5523563 (+0%) packages/x86-64-v3-poky-linux/libxml2/libxml2-src: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-staticdev: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-staticdev: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2-utils: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2-utils: PV changed from "2.15.3" to "2.15.4" packages/x86-64-v3-poky-linux/libxml2/libxml2: PKGV changed from 2.15.3 [default] to 2.15.4 [default] packages/x86-64-v3-poky-linux/libxml2/libxml2: FILELIST: removed "/usr/lib/libxml2.so.16.1.3", added "/usr/lib/libxml2.so.16.1.4" packages/x86-64-v3-poky-linux/libxml2/libxml2: PV changed from "2.15.3" to "2.15.4" Changes to packages/x86-64-v3-poky-linux/libxml2 (sysroot): /usr/lib/libxml2.so.16 changed symlink target from libxml2.so.16.1.3 to libxml2.so.16.1.4 /usr/lib/libxml2.so changed symlink target from libxml2.so.16.1.3 to libxml2.so.16.1.4 /usr/lib/libxml2.so.16.1.3 moved to /usr/lib/libxml2.so.16.1.4 Changes to packages/x86_64-linux/elfutils-native (sysroot): /usr/bin/eu-stackprof was added
packages/x86-64-v3-poky-linux/libxml2/libxml2-ptest: FILELIST: added "/usr/lib/libxml2/ptest/test/schemas/date-whitespace_0.xml /usr/lib/libxml2/ptest/test/schemas/date-whitespace_1.xml /usr/lib/libxml2/ptest/result/XInclude/issue1120-2.xml /usr/lib/libxml2/ptest/test/schemas/date-whitespace_0.xsd /usr/lib/libxml2/ptest/test/XInclude/issue1120/issue1120-1.xml /usr/lib/libxml2/ptest/result/XInclude/issue1120-2.xml.err /usr/lib/libxml2/ptest/test/catalogs/next-catalog-missing-attr.xml /usr/lib/libxml2/ptest/result/XInclude/issue1120-1.xml.err /usr/lib/libxml2/ptest/result/schemas/date-whitespace_0_1.err /usr/lib/libxml2/ptest/result/schemas/date-whitespace_0_0.err /usr/lib/libxml2/ptest/result/XInclude/issue1120-1.xml /usr/lib/libxml2/ptest/test/XInclude/issue1120/issue1120-2.xml" packages/x86-64-v3-poky-linux/libxml2/libxml2: FILELIST: removed "/usr/lib/libxml2.so.16.1.3", added "/usr/lib/libxml2.so.16.1.4" Changes to packages/x86-64-v3-poky-linux/libxml2 (sysroot): /usr/lib/libxml2.so.16 changed symlink target from libxml2.so.16.1.3 to libxml2.so.16.1.4 /usr/lib/libxml2.so changed symlink target from libxml2.so.16.1.3 to libxml2.so.16.1.4 /usr/lib/libxml2.so.16.1.3 moved to /usr/lib/libxml2.so.16.1.4 Changes to packages/x86_64-linux/elfutils-native (sysroot): /usr/bin/eu-stackprof was added
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245132): https://lists.openembedded.org/g/openembedded-core/message/245132 Mute This Topic: https://lists.openembedded.org/mt/121098216/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
