linux/poky.git/meta/recipes-core/libxml, branch yocto-3.1.23

libxml2: Fix CVE-2022-40304

2022-12-07T15:06:36+00:00

Fix dict corruption caused by entity reference cycles Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b Upstream-Status: Pending (From OE-Core rev: 8e195f0a01b4cc1017bf9df67ffc3c6d6c15d24a) Signed-off-by: Bhabu Bindu Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Fix CVE-2022-40303

2022-12-07T15:06:36+00:00

Fix integer overflows with XML_PARSE_HUGE Link: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 Upstream-Status: Pending (From OE-Core rev: d16d5660a32386158632ee5599ad92a9f2dc08dd) Signed-off-by: Bhabu Bindu Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Add fix for CVE-2016-3709

2022-09-03T12:10:37+00:00

Add below patch to fix CVE-2016-3709 CVE-2016-3709.patch Link: https://github.com/GNOME/libxml2/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f (From OE-Core rev: b9312041e4c8d565ad1e1102f8634bcc913adfa7) Signed-off-by: Pawan Badganchi Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Port gentest.py to Python-3

2022-08-18T16:52:23+00:00

* but it still won't work well on hosts without libxml2, make sure to use pre-generated testapi.c in do_compile_ptest * this is reproducible with SOURCE_DATE_EPOCH set to 0 which e.g. meta-updater still sets by default for DISTROs which use it :(, see https://github.com/uptane/meta-updater/pull/35 (From OE-Core rev: 2f78dbcb300e7deae6cf39263e874ee8776d7a7b) Signed-off-by: Martin Jansa Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Fix CVE-2022-29824 for libxml2

2022-06-04T11:16:59+00:00

Add patch for CVE issue: CVE-2022-29824 CVE-2022-29824 Link: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab] Dependent patch: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b] (From OE-Core rev: 096ca5fa8cc4672e5e9b25dffe81b176b252d570) Signed-off-by: Riyaz Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: fix CVE-2022-23308 regression

2022-03-31T20:09:33+00:00

The fix for the CVE in 2.9.13 caused a regression which was addressed after 2.9.13. We import that patch here. (From OE-Core rev: 906ffe5bf83c0e587299aaedb9382ce04c3c7acf) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

oeqa/runtime/ping: Improve failure message to include more detail

2022-03-23T23:16:12+00:00

When the ping test fails due to a timeout we only get limited debug information. Tweak the code to improve that in case it sheds any light on intermittent failures. (From OE-Core rev: df98e96c7a1601798caf7f4882b09406a4fdacd6) Signed-off-by: Richard Purdie (cherry picked from commit d81704057950e1970ef7f673fa771834fd2b3f1e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: move to gitlab.gnome.org

2022-03-23T23:16:12+00:00

The project has migrated from www.xmlsoft.org to gitlab.gnome.org. Update the homepage accordingly, and use gnomebase to construct the download URL, rather than including it in SRC_URI explicitly. Note that the download is now in .xz format rather than .gz, so the sha256sum is updated accordingly. Post-decompression tarballs are identical, so there is no change to the libxml2 code. (From OE-Core rev: 38681a213a3b5f57b37257f7d96c4e970032ffe4) Signed-off-by: Ralph Siemsen Signed-off-by: Richard Purdie (cherry picked from commit 8bc17ceb997f8f31a03e5f5efc41c03ef1df3add) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: backport fix for CVE-2022-23308

2022-03-23T23:16:12+00:00

Use-after-free of ID and IDREF attributes, which could result in denial of service. https://nvd.nist.gov/vuln/detail/CVE-2022-23308 CVE: CVE-2022-23308 (From OE-Core rev: 6c2f91ce93921c9bfe52c62c0347b992df98d62d) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Use python3targetconfig to fix reproducibility issue

2021-10-23T22:14:17+00:00

We're seeing pthread being linked sometimes and not others leading to non-reproducible target binaries. The reason is mixing the native python config with the target one. We should use the target one. (From OE-Core rev: e570efa43d5655afa041bd4ab52fec2de2216e4d) Signed-off-by: Richard Purdie (cherry picked from commit 1bc5378db760963e2ad46542f2907dd6a592eb66) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie