From f2422aad3b7ea08935df880a63b3be81daf0c898 Mon Sep 17 00:00:00 2001 From: Ovidiu Panait Date: Wed, 9 Sep 2020 11:11:53 +0300 Subject: libxml2: Fix CVE-2020-24977 GNOME project libxml2 v2.9.10 and earlier have a global Buffer Overflow vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1). Reference: https://gitlab.gnome.org/GNOME/libxml2/-/issues/178 Upstream patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2 (From OE-Core rev: d5406b389fcae8fb0f5fc9cc7dbf7ee819c04bc8) Signed-off-by: Ovidiu Panait Signed-off-by: Richard Purdie (cherry picked from commit 92dc02b8f03f3586de0a2ec1463b189a3918e303) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/recipes-core/libxml/libxml2_2.9.10.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-core/libxml/libxml2_2.9.10.bb') diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb index 097aceb2c0..4ebfb9e556 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb @@ -22,6 +22,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \ file://fix-execution-of-ptests.patch \ file://CVE-2020-7595.patch \ file://CVE-2019-20388.patch \ + file://CVE-2020-24977.patch \ " SRC_URI[libtar.md5sum] = "10942a1dc23137a8aa07f0639cbfece5" -- cgit v1.2.3-54-g00ecf