openembedded-core.git/meta/recipes-core/libxml/libxml2, branch morty

libxml2: Fix more NULL pointer derefs

2017-01-11T11:46:53+00:00

The NULL pointer dereferencing could produced some
security problems.
This is a preventive security fix.

(From OE-Core rev: 8f3008114d5000a0865f50833db7c3a3f9808601)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: fix CVE-2016-4658 Disallow namespace nodes in XPointer points and ranges

2017-01-11T11:46:53+00:00

Namespace nodes must be copied to avoid use-after-free errors.
But they don't necessarily have a physical representation in a
document, so simply disallow them in XPointer ranges.

(From OE-Core rev: 00e928bd1c2aed9caeaf9e411743805d2139a023)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: Necessary changes before fixing CVE-2016-5131

2017-01-11T11:46:53+00:00

xpath:
 - Check for errors after evaluating first operand.
 - Add sanity check for empty stack.
 - Include comparation in changes from xmlXPathCmpNodesExt to xmlXPathCmpNodes

(From OE-Core rev: 96ef568f75dded56a2123b63dcc8b443f796afe0)

Signed-off-by: Andrej Valek 
Signed-off-by: Pascal Bach 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: Security fix CVE-2016-5131

2017-01-11T11:46:44+00:00

CVE-2016-5131 libxml2: Use-after-free vulnerability in libxml2 through
2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote
attackers to cause a denial of service or possibly have unspecified
other impact via vectors related to the XPointer range-to function.

External References:
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5131

Patch from:
https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e

(From OE-Core rev: 640bd2b98ff33e49b42f1087650ebe20d92259a4)

Signed-off-by: Yi Zhao 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie 
Signed-off-by: Armin Kuster

libxml2: upgrade to 2.9.4

2016-06-14T11:56:33+00:00

- Drop configure.ac-fix-cross-compiling-warning.patch,
  libxml2 2.9.4 has fixed it

Signed-off-by: Hongxu Jia 
Signed-off-by: Richard Purdie

libxml2: fix AM_PATH_XML2

2016-04-09T06:50:25+00:00

The code: suppose $1 == 2.7:
verdep=ifelse([$1], [], [], [>= $1])
results in:
verdep=>= 2.7
This is wrong in shell:
bash: 2.7: command not found

Use quotation marks to fix the problem.

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie

libxml2: upgrade to 2.9.3

2015-12-01T21:31:03+00:00

- Drop all the upstreamed patches
- Rework the ansidecl removal so it's contained in a single patch

Signed-off-by: Ross Burton

libxml2: fix CVE-2015-7942 and CVE-2015-8035

2015-11-25T07:56:57+00:00

CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections()
CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

[YOCTO #8641]

Signed-off-by: Armin Kuster 
Signed-off-by: Ross Burton

libxml2: Security Advisory - libxml2 - CVE-2015-1819

2015-06-18T08:12:02+00:00

for CVE-2015-1819 Enforce the reader to run in constant memory

Signed-off-by: Yue Tao 
Signed-off-by: Wenzong Fan 
Signed-off-by: Ross Burton

libxml2: remove libxml2-CVE-2014-3660.patch

2015-04-30T22:01:26+00:00

It is a backport patch, and verified that the patch is in the source.

Signed-off-by: Robert Yang 
Signed-off-by: Richard Purdie