openembedded-core.git/meta/recipes-core/libxml/libxml2, branch master

libxml2: CVE-2016-9318

2017-04-28T10:26:07+00:00

libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier
and other products, does not offer a flag directly indicating that
the current document may be read but other files may not be opened,
which makes it easier for remote attackers to conduct XML External
Entity (XXE) attacks via a crafted document.

Reference:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9318

Upstream patch:
https://git.gnome.org/browse/libxml2/commit/?id=2304078555896cf1638c628f50326aeef6f0e0d0

Signed-off-by: Catalin Enache 
Signed-off-by: Ross Burton

libxml2: Fix more NULL pointer derefs

2016-12-16T08:30:02+00:00

The NULL pointer dereferencing could produced some
security problems.
This is a preventive security fix.

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ranges

2016-12-16T08:30:01+00:00

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: Necessary changes before fixing CVE-2016-5131

2016-12-16T08:30:01+00:00

xpath:
 - Check for errors after evaluating first operand.
 - Add sanity check for empty stack.
 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton

libxml2: Security fix CVE-2016-5131

2016-11-30T15:47:15+00:00

CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through
2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the XPointer range-to function.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131

Patch from:
https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e

Signed-off-by: Yi Zhao 
Signed-off-by: Ross Burton

libxml2: upgrade to 2.9.4

2016-06-14T11:56:33+00:00

- Drop configure.ac-fix-cross-compiling-warning.patch,
  libxml2 2.9.4 has fixed it

Signed-off-by: Hongxu Jia 
Signed-off-by: Richard Purdie

libxml2: fix AM_PATH_XML2

2016-04-09T06:50:25+00:00

The code: suppose $1 == 2.7:
verdep=ifelse([$1], [], [], [>= $1])
results in:
verdep=>= 2.7
This is wrong in shell:
bash: 2.7: command not found

Use quotation marks to fix the problem.

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

libxml2: upgrade to 2.9.3

2015-12-01T21:31:03+00:00

- Drop all the upstreamed patches
- Rework the ansidecl removal so it's contained in a single patch

Signed-off-by: Ross Burton

libxml2: fix CVE-2015-7942 and CVE-2015-8035

2015-11-25T07:56:57+00:00

CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections()
CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

[YOCTO #8641]

Signed-off-by: Armin Kuster 
Signed-off-by: Ross Burton

libxml2: Security Advisory - libxml2 - CVE-2015-1819

2015-06-18T08:12:02+00:00

for CVE-2015-1819 Enforce the reader to run in constant memory

Signed-off-by: Yue Tao 
Signed-off-by: Wenzong Fan 
Signed-off-by: Ross Burton