From 2159b5f8ae1969e21bafe38b9c84be257973c9fd Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 28 Feb 2025 18:16:58 +0100 Subject: libxml2: mark patch as fixing CVE-2025-27113 This vulnerability has now a CVE assigned. (From OE-Core rev: 204ff9dd9c62a8a346e89880b2e15a4c0e9ad6e0) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- ...rn-Fix-compilation-of-explicit-child-axis.patch | 31 --------------------- .../libxml/libxml2/CVE-2025-27113.patch | 32 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.14.bb | 2 +- 3 files changed, 33 insertions(+), 32 deletions(-) delete mode 100644 meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch (limited to 'meta/recipes-core') diff --git a/meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch b/meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch deleted file mode 100644 index 932c0ec422..0000000000 --- a/meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 503f788e84f1c1f1d769c2c7258d77faee94b5a3 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Thu, 13 Feb 2025 16:48:53 +0100 -Subject: [PATCH] pattern: Fix compilation of explicit child axis - -The child axis is the default axis and should generate XML_OP_ELEM like -the case without an axis. - -Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/503f788e84f1c1f1d769c2c7258d77faee94b5a3] -Signed-off-by: Peter Marko ---- - pattern.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pattern.c b/pattern.c -index 27e96946..3182794e 100644 ---- a/pattern.c -+++ b/pattern.c -@@ -1178,10 +1178,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) { - goto error; - } - } else { -- PUSH(XML_OP_CHILD, token, URL); -+ PUSH(XML_OP_ELEM, token, URL); - } - } else -- PUSH(XML_OP_CHILD, name, NULL); -+ PUSH(XML_OP_ELEM, name, NULL); - return; - } else if (xmlStrEqual(name, (const xmlChar *) "attribute")) { - XML_PAT_FREE_STRING(ctxt, name) diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch new file mode 100644 index 0000000000..92713375eb --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch @@ -0,0 +1,32 @@ +From 503f788e84f1c1f1d769c2c7258d77faee94b5a3 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Thu, 13 Feb 2025 16:48:53 +0100 +Subject: [PATCH] pattern: Fix compilation of explicit child axis + +The child axis is the default axis and should generate XML_OP_ELEM like +the case without an axis. + +CVE: CVE-2025-27113 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/503f788e84f1c1f1d769c2c7258d77faee94b5a3] +Signed-off-by: Peter Marko +--- + pattern.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pattern.c b/pattern.c +index 27e96946..3182794e 100644 +--- a/pattern.c ++++ b/pattern.c +@@ -1178,10 +1178,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) { + goto error; + } + } else { +- PUSH(XML_OP_CHILD, token, URL); ++ PUSH(XML_OP_ELEM, token, URL); + } + } else +- PUSH(XML_OP_CHILD, name, NULL); ++ PUSH(XML_OP_ELEM, name, NULL); + return; + } else if (xmlStrEqual(name, (const xmlChar *) "attribute")) { + XML_PAT_FREE_STRING(ctxt, name) diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb index 8f1d882505..1cbd620b34 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.14.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb @@ -34,7 +34,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt file://CVE-2024-25062.patch \ file://CVE-2024-34459.patch \ file://CVE-2022-49043.patch \ - file://0001-pattern-Fix-compilation-of-explicit-child-axis.patch \ + file://CVE-2025-27113.patch \ file://CVE-2024-56171.patch \ file://CVE-2025-24928.patch \ " -- cgit v1.2.3-54-g00ecf