linux/poky.git/meta/recipes-core/libxml/libxml2, branch uninative-1.7

meta: Fix malformed Upstream-Status tags

2017-06-27T09:38:43+00:00

Fix a variety of spelling and format mistakes to improve the ease of reading the tags programatically. (From OE-Core rev: 6e1aaf80b0d951b48cd25cb7161ec19448295094) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

libxml2: Revert "Add an XML_PARSE_NOXXE flag to block all entities loading even local"

2017-06-23T10:44:13+00:00

The new flag doesn't work and the change even broke the XML_PARSE_NONET option. (From OE-Core rev: 8b586f60778579ee2c9adae429128a07e8437553) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Fix CVE-2017-0663

2017-06-23T10:44:13+00:00

Fix type confusion in xmlValidateOneNamespace Comment out code that casts xmlNsPtr to xmlAttrPtr. ID types on namespace declarations make no practical sense anyway. Fixes bug 780228 CVE: CVE-2017-0663 (From OE-Core rev: a965be7b6a1d730851b4a3bc8fd534b9b2334227) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Fix CVE-2017-5969

2017-06-23T10:44:13+00:00

Fix NULL pointer deref in xmlDumpElementContent Can only be triggered in recovery mode. Fixes bug 758422 CVE: CVE-2017-5969 (From OE-Core rev: 0cae039cbe513b7998e067f4f3958af2ec65ed1a) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Fix CVE-2017-9049 and CVE-2017-9050

2017-06-23T10:44:13+00:00

Fix handling of parameter-entity references There were two bugs where parameter-entity references could lead to an unexpected change of the input buffer in xmlParseNameComplex and xmlDictLookup being called with an invalid pointer. Fixes bug 781205 and bug 781361 CVE: CVE-2017-9049 CVE-2017-9050 (From OE-Core rev: 2300762fef8fc8e3e56fb07fd4076c1deeba0a9b) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Fix CVE-2017-9047 and CVE-2017-9048

2017-06-23T10:44:13+00:00

xmlSnprintfElementContent failed to correctly check the available buffer space in two locations. Fixes bug 781333 and bug 781701 CVE: CVE-2017-9047 CVE-2017-9048 (From OE-Core rev: bb0af023e811907b4e641b39f654ca921ac8794a) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Avoid reparsing and simplify control flow in xmlParseStartTag2

2017-06-23T10:44:13+00:00

(From OE-Core rev: 4651afdd457eca06da07331186bf28b98df2eeff) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Disable LeakSanitizer when running API tests

2017-06-23T10:44:13+00:00

Makefile.am: Disable LeakSanitizer when running API tests The autogenerated API tests leak memory. Upstream-Status: Backported - [https://git.gnome.org/browse/libxml2/commit/?id=ac9a4560ee85b18811ff8ab7791ddfff7b144b0a] (From OE-Core rev: e3985be0ddb40e8db44422092c875a4e373a6da3) Signed-off-by: Andrej Valek Signed-off-by: Richard Purdie

libxml2: Make ptest run the Python tests if Python support is enabled

2017-06-12T22:01:22+00:00

Since we go through the trouble of copying the Python tests, we may as well actually run them... This also avoids the following QA issue: ERROR: libxml2-2.9.4-r0 do_package_qa: QA Issue: /usr/lib/libxml2/ptest/python/tests/push.py contained in package libxml2-ptest requires /usr/bin/python, but no providers found in RDEPENDS_libxml2-ptest? [file-rdeps] (From OE-Core rev: 65bc9fac6dc6ba5252bf105659724c768d65f9d9) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

libxml2: CVE-2016-9318

2017-04-29T10:17:23+00:00

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318 Upstream patch: https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0 (From OE-Core rev: 0dd44c00e3b2fbc3befc3f361624a3a60161d979) Signed-off-by: Catalin Enache Signed-off-by: Ross Burton Signed-off-by: Richard Purdie