Includes bug fixes and fixes for CVE-2018-9251, CVE-2018-14567, and CVE-2018-14404.
The patch for CVE-2017-8872 was removed. Although there's nothing about that in the changelogs, the underlying problem was solved with 2.9.9: https://mail.gnome.org/archives/xml/2019-January/msg00011.html Signed-off-by: Alexander Dahl <[email protected]> --- ...ut-of-bounds-read-in-htmlParseTryOrFinish.patch | 31 ---------------------- .../0200-xml2-config-is-not-SYSROOT-aware.patch | 0 patches/{libxml2-2.9.7 => libxml2-2.9.9}/series | 4 +-- rules/libxml2.make | 4 +-- 4 files changed, 3 insertions(+), 36 deletions(-) delete mode 100644 patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch rename patches/{libxml2-2.9.7 => libxml2-2.9.9}/0200-xml2-config-is-not-SYSROOT-aware.patch (100%) rename patches/{libxml2-2.9.7 => libxml2-2.9.9}/series (47%) diff --git a/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch b/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch deleted file mode 100644 index c23cb47e5..000000000 --- a/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Marcus Meissner <[email protected]> -Date: Wed, 3 Jan 2018 14:43:41 +0100 -Subject: [PATCH] Out-of-bounds read in htmlParseTryOrFinish - -Origin: vendor, https://bugzilla.novell.com/attachment.cgi?id=732309 -Bug: https://bugzilla.gnome.org/show_bug.cgi?id=775200 -Bug-Debian: https://bugs.debian.org/862450 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-8872 -Bug-SUSE: https://bugzilla.novell.com/show_bug.cgi?id=1038444 -Forwarded: yes, https://bugzilla.gnome.org/attachment.cgi?id=366193 -Reviewed-by: Salvatore Bonaccorso <[email protected]> -Last-Update: 2018-01-03 ---- - parser.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/parser.c b/parser.c -index 1c5e036ea265..025111067ae8 100644 ---- a/parser.c -+++ b/parser.c -@@ -12467,6 +12467,10 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) { - ctxt->input->cur = BAD_CAST""; - ctxt->input->base = ctxt->input->cur; - ctxt->input->end = ctxt->input->cur; -+ if (ctxt->input->buf) -+ xmlBufEmpty (ctxt->input->buf->buffer); -+ else -+ ctxt->input->length = 0; - } - } - diff --git a/patches/libxml2-2.9.7/0200-xml2-config-is-not-SYSROOT-aware.patch b/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch similarity index 100% rename from patches/libxml2-2.9.7/0200-xml2-config-is-not-SYSROOT-aware.patch rename to patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch diff --git a/patches/libxml2-2.9.7/series b/patches/libxml2-2.9.9/series similarity index 47% rename from patches/libxml2-2.9.7/series rename to patches/libxml2-2.9.9/series index 07fceed7b..198075fbf 100644 --- a/patches/libxml2-2.9.7/series +++ b/patches/libxml2-2.9.9/series @@ -1,7 +1,5 @@ # generated by git-ptx-patches #tag:base --start-number 1 -#tag:debian --start-number 100 -0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch #tag:ptx --start-number 200 0200-xml2-config-is-not-SYSROOT-aware.patch -# 5b451bf42a96789ecd1e84388af58f95 - git-ptx-patches magic +# 9a7de85eef8cb30919e83bc9b2e42cd9 - git-ptx-patches magic diff --git a/rules/libxml2.make b/rules/libxml2.make index ab8c6f561..234e85f3e 100644 --- a/rules/libxml2.make +++ b/rules/libxml2.make @@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_LIBXML2) += libxml2 # # Paths and names # -LIBXML2_VERSION := 2.9.7 -LIBXML2_MD5 := 896608641a08b465098a40ddf51cefba +LIBXML2_VERSION := 2.9.9 +LIBXML2_MD5 := c04a5a0a042eaa157e8e8c9eabe76bd6 LIBXML2 := libxml2-$(LIBXML2_VERSION) LIBXML2_SUFFIX := tar.gz LIBXML2_SOURCE := $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX) -- 2.11.0 _______________________________________________ ptxdist mailing list [email protected]
