linux/poky.git/meta/recipes-core/libxml, branch walnascar

libxml2: patch CVE-2025-6170

2025-08-04T16:12:23+00:00

Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 1dab0ba31fd09911d4fa707c1318bb0e83f46cdd) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libxml2: fix CVE-2025-49795

2025-07-21T16:18:00+00:00

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. Pick commit from 2.13 branch Reference: https://security-tracker.debian.org/tracker/CVE-2025-49795 Upstream-patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278a4c5fdf14d287dfb400005c0a0caa69f (From OE-Core rev: 9f17e0911eeb49e007de8ee3e50d9f3f38e08a26) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libxml2: Fix CVE-2025-49794 & CVE-2025-49796

2025-07-21T16:17:59+00:00

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory. References: https://security-tracker.debian.org/tracker/CVE-2025-49794 https://security-tracker.debian.org/tracker/CVE-2025-49796 Upstream-patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/71e1e8af5ee46dad1b57bb96cfbf1c3ad21fbd7b (From OE-Core rev: b0f34931f7ae35538d007add80e2f81c85fa950f) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libxml2: fix CVE-2025-6021

2025-07-21T16:17:59+00:00

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6021 Upstream-patch: https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae33c23f87692aa179bacedb6743f3188a (From OE-Core rev: 99a239d9146c5ecf158cd9db7823ec1aff45fd48) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libxml2: upgrade 2.13.6 -> 2.13.8

2025-05-23T15:42:34+00:00

This includes CVE-fix for CVE-2025-32414 and CVE-2025-32415. Changelog: =========== https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.7 https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8 Regressions * tree: Fix xmlTextMerge with NULL args * io: Fix compressed flag for uncompressed stdin * parser: Fix parsing of DTD content Security * [CVE-2025-32415] schemas: Fix heap buffer overflow inxmlSchemaIDCFillNodeTables * [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver) (From OE-Core rev: 7680e9a11a63ab8bfbc915e4cf6a385f0970c4a5) Signed-off-by: Divya Chellam Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 0b24113405ab0bbb3200bb47fa8ed6abeaa7481b) Signed-off-by: Steve Sakoman

libxml2: upgrade 2.13.5 -> 2.13.6

2025-02-20T11:57:49+00:00

https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6 Release notes Security [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd pattern: Fix compilation of explicit child axis Regressions xmllint: Support compressed input from stdin uri: Fix handling of Windows drive letters reader: Fix return value of xmlTextReaderReadString again SAX2: Fix xmlSAX2ResolveEntity if systemId is NULL Portability dict: Handle ENOSYS from getentropy gracefully Fix compilation with uclibc (Dario Binacchi) python: Declare init func with PyMODINIT_FUNC tests: Fix sanitizer version check on old Apple clang cmake: Work around broken sys/random.h in old macOS SDKs Build autotools: Set AC_CONFIG_AUX_DIR cmake: Always build Python module as shared library cmake: add missing Bcrypt link on Windows (Saleem Abdulrasool) cmake: Fix compatibility in package version file (From OE-Core rev: 86e16b1081fbe12b4f53fc72bfdff5240da7321a) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libxml2: upgrade 2.13.4 -> 2.13.5

2024-11-19T12:54:32+00:00

https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.5 Regressions * xmlIO: Fix reading from non-regular files like pipes * xmlreader: Fix return value of xmlTextReaderReadString * parser: Fix loading of parameter entities in external DTDs * parser: Fix downstream code that swaps DTDs * parser: Fix detection of duplicate attributes * string: Fix va_copy fallback Bug fixes * xpath: Fix parsing of non-ASCII names (From OE-Core rev: c6dc275850d5a98803eee7d4712bb66b19051c82) Signed-off-by: Guðni Már Gilbert Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: upgrade 2.13.3 -> 2.13.4

2024-10-18T14:01:04+00:00

Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.4 (From OE-Core rev: b8e00689bf3ceaa27c015df32a88ada27b1810a7) Signed-off-by: Jason Schonberg Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: 2.12.8 -> 2.13.3

2024-08-23T21:43:27+00:00

* Remove Trio and updated Copyright to remove Trio [1] * Remove --with-fexceptions configuration option [2] [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/7d6969d95509a94347d6f96167ac5420abafa291 [2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/e349709ae7e07a2183304ccc9352b6ac86f62a18 (From OE-Core rev: 786a24228ee0793f43258133c7e5df6acb3e9de2) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

libxml2: Upgrade 2.12.7 -> 2.12.8

2024-06-24T11:43:40+00:00

Changes between 2.12.7 -> 2.12.8 ================================ Regression Fixed: parser: Fix performance regression when parsing namespaces (From OE-Core rev: 15eb0b6531a97f85c1b098fb51de9126f2221248) Signed-off-by: Siddharth Doshi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie