From 0c0b8487c96a6199f8a9bf5f457867167dd12474 Mon Sep 17 00:00:00 2001 From: Ralph Siemsen Date: Fri, 11 Mar 2022 15:37:58 -0500 Subject: libxml2: backport fix for CVE-2022-23308 Use-after-free of ID and IDREF attributes, which could result in denial of service. https://nvd.nist.gov/vuln/detail/CVE-2022-23308 CVE: CVE-2022-23308 (From OE-Core rev: 6c2f91ce93921c9bfe52c62c0347b992df98d62d) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-core/libxml/libxml2_2.9.10.bb') diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb index ebb996c8dd..1b22e5672c 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb @@ -27,6 +27,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \ file://CVE-2021-3537.patch \ file://CVE-2021-3518.patch \ file://CVE-2021-3541.patch \ + file://CVE-2022-23308.patch \ " SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" -- cgit v1.2.3-54-g00ecf