linux/poky.git/meta/recipes-core/libxml, branch master

The poky repository master branch is no longer being updated.

2025-11-07T13:31:53+00:00

You can either: a) switch to individual clones of bitbake, openembedded-core, meta-yocto and yocto-docs b) use the new bitbake-setup You can find information about either approach in our documentation: https://docs.yoctoproject.org/ Note that "poky" the distro setting is still available in meta-yocto as before and we continue to use and maintain that. Long live Poky! Some further information on the background of this change can be found in: https://lists.openembedded.org/g/openembedded-architecture/message/2179 Signed-off-by: Richard Purdie

libxml2: upgrade 2.14.5 -> 2.14.6

2025-09-11T10:31:55+00:00

(From OE-Core rev: 28af77eea6fe04c923d57b8b20ad24414ffc8621) Signed-off-by: Wang Mingyu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

recipes: cleanup CVE_STATUS which are resolved now

2025-08-28T09:47:08+00:00

The don't show up in CVE metrics anymore since they were either fixed upstream or recipe version was upgraded meanwhile. * bind CVE-2019-6470: cpe got corrected in nvd db * libxml2 CVE-2023-45322: version is now higher than NVD cpe * zlib CVE-2023-45853: version is now higher than NVD cpe * gcc CVE-2021-37322: version is now higher than NVD cpe * python3 * CVE-2007-4559: version is now higher than NVD cpe * CVE-2019-18348: version is now higher than NVD cpe * CVE-2020-15523: version is now higher than NVD cpe * CVE-2022-26488: version is now higher than NVD cpe * CVE-2015-20107: version is now higher than NVD cpe * CVE-2023-36632: version is now higher than NVD cpe * rust * CVE-2024-24576: NVD has no cpe, but we have newer version as fix * CVE-2024-43402: version is now higher than NVD cpe * cups CVE-2021-25317: version is now higher than NVD cpe * ghostscript CVE-2023-38559: version is now higher than NVD cpe * libtirpc CVE-2021-46828: version is now higher than NVD cpe * unzip CVE-2008-0888: version is now higher than NVD cpe * ffmpeg CVE-2023-39018: cpe got corrected in nvd db * libxslt CVE-2022-29824: version is now higher than NVD cpe * libyaml * CVE-2024-35325: CVE is now rejected in NVD DB * CVE-2024-35326: CVE is now rejected in NVD DB * CVE-2024-35328: CVE is now rejected in NVD DB Also add comment for iputils regarding reports for FKIE/NVD2. Also remove some trailing spaces in python recipe. (From OE-Core rev: 73ee9789183aa95072af2b51ac9e08203f4e33f9) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: mark CVE-2025-6170 as fixed

2025-08-25T16:47:21+00:00

As shown in [1] when expanding tags including it. NVD tracks this CVE as version-less. [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434 (From OE-Core rev: d8a9c190811ad9658a74502a371c110f4d24d68f) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: upgrade 2.14.3 -> 2.14.5

2025-07-28T13:51:50+00:00

Release notes: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.14.5 (From OE-Core rev: b82cb6d55033ffff79b5a767bd50b06989c0acfc) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libxml2: fix CVE-2025-6021

2025-06-16T16:57:30+00:00

According to [1] A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. Refer debian [2], backport a fix [3] from upstream [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6021 [2] https://security-tracker.debian.org/tracker/CVE-2025-6021 [3] https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0 (From OE-Core rev: e3a6bf785656243b5adc0775f7480a1eb0e4ae4c) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libxml2: revert commit breaking patchs in cmake file

2025-05-27T08:01:17+00:00

Make a revert of commit which breaks cross-compilation of depending components. This commit changes path calculation from relative to cmake file to absolute from includedir, which points then the host /usr/include. Submitted upstream ticket [1] to clarify how this should be fixed in libxml2 upstream. [1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/898#note_2452864 (From OE-Core rev: bc93853c8d2e1da10c000a477093e293fa637761) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

libxml2: upgrade 2.13.6 -> 2.14.3

2025-05-27T08:01:17+00:00

Handle CVE-2025-32414 and CVE-2025-32415. * rebased install-tests.patch * removed testsuite testThreads (merged into runtest.c) * https://gitlab.gnome.org/GNOME/libxml2/-/commit/481fd6bbee029e15a6a4015e5160a332d7c18cba * removed IPv6 option (as part of with ftp support removal) * https://gitlab.gnome.org/GNOME/libxml2/-/commit/dba1ed85a320c36807ee09f44d09fd30852b9370 * added testsuites testlimits testparser (already present before but not executed) License-Update: Mention contributors in Copyright https://gitlab.gnome.org/GNOME/libxml2/-/commit/4bd66d4549b2e8925a752e0daac3a189d2fec8f7 (From OE-Core rev: 6585649fdd2ab9e83dfd60eb77ff7821a1363d50) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: upgrade 2.13.6 -> 2.13.8

2025-05-01T13:22:54+00:00

This includes CVE-fix for CVE-2025-32414 and CVE-2025-32415. Changelog: =========== https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.7 https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8 Regressions * tree: Fix xmlTextMerge with NULL args * io: Fix compressed flag for uncompressed stdin * parser: Fix parsing of DTD content Security * [CVE-2025-32415] schemas: Fix heap buffer overflow inxmlSchemaIDCFillNodeTables * [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver) (From OE-Core rev: 0b24113405ab0bbb3200bb47fa8ed6abeaa7481b) Signed-off-by: Divya Chellam Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: upgrade 2.13.5 -> 2.13.6

2025-02-20T11:57:49+00:00

https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6 Release notes Security [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd pattern: Fix compilation of explicit child axis Regressions xmllint: Support compressed input from stdin uri: Fix handling of Windows drive letters reader: Fix return value of xmlTextReaderReadString again SAX2: Fix xmlSAX2ResolveEntity if systemId is NULL Portability dict: Handle ENOSYS from getentropy gracefully Fix compilation with uclibc (Dario Binacchi) python: Declare init func with PyMODINIT_FUNC tests: Fix sanitizer version check on old Apple clang cmake: Work around broken sys/random.h in old macOS SDKs Build autotools: Set AC_CONFIG_AUX_DIR cmake: Always build Python module as shared library cmake: add missing Bcrypt link on Windows (Saleem Abdulrasool) cmake: Fix compatibility in package version file (From OE-Core rev: 86e16b1081fbe12b4f53fc72bfdff5240da7321a) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie