fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113
This commit is contained in:
Funda Wang
parent
cdb51cff0c
commit
e5a7e1edd1
41
backport-CVE-2024-56171.patch
Normal file
41
backport-CVE-2024-56171.patch
Normal file
@ -0,0 +1,41 @@
|
||||
From 245b70d7d2768572ae1b05b3668ca858b9ec4ed4 Mon Sep 17 00:00:00 2001
|
||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||||
Date: Tue, 10 Dec 2024 16:52:05 +0100
|
||||
Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after
|
||||
xmlSchemaItemListAdd
|
||||
|
||||
xmlSchemaItemListAdd can reallocate the items array. Update local
|
||||
variables after adding item in
|
||||
|
||||
- xmlSchemaIDCFillNodeTables
|
||||
- xmlSchemaBubbleIDCNodeTables
|
||||
|
||||
Fixes #828.
|
||||
---
|
||||
xmlschemas.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/xmlschemas.c b/xmlschemas.c
|
||||
index d276faf10..28b14bd44 100644
|
||||
--- a/xmlschemas.c
|
||||
+++ b/xmlschemas.c
|
||||
@@ -23388,6 +23388,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
|
||||
}
|
||||
if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1)
|
||||
goto internal_error;
|
||||
+ dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items;
|
||||
/*
|
||||
* Remove the duplicate entry from the IDC node-table.
|
||||
*/
|
||||
@@ -23604,6 +23605,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt)
|
||||
goto internal_error;
|
||||
}
|
||||
xmlSchemaItemListAdd(parBind->dupls, parNode);
|
||||
+ dupls = (xmlSchemaPSVIIDCNodePtr *)
|
||||
+ parBind->dupls->items;
|
||||
} else {
|
||||
/*
|
||||
* Add the node-table entry (node and key-sequence) of
|
||||
--
|
||||
GitLab
|
||||
|
||||
57
backport-CVE-2025-24928.patch
Normal file
57
backport-CVE-2025-24928.patch
Normal file
@ -0,0 +1,57 @@
|
||||
From 858ca26c0689161a6b903a6682cc8a1cc10a0ea8 Mon Sep 17 00:00:00 2001
|
||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||||
Date: Tue, 11 Feb 2025 17:30:40 +0100
|
||||
Subject: [PATCH] [CVE-2025-24928] Fix stack-buffer-overflow in
|
||||
xmlSnprintfElements
|
||||
|
||||
Fixes #847.
|
||||
---
|
||||
valid.c | 25 +++++++++++++------------
|
||||
1 file changed, 13 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/valid.c b/valid.c
|
||||
index 76d657d62..abefdc50a 100644
|
||||
--- a/valid.c
|
||||
+++ b/valid.c
|
||||
@@ -5057,25 +5057,26 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
|
||||
return;
|
||||
}
|
||||
switch (cur->type) {
|
||||
- case XML_ELEMENT_NODE:
|
||||
+ case XML_ELEMENT_NODE: {
|
||||
+ int qnameLen = xmlStrlen(cur->name);
|
||||
+
|
||||
+ if ((cur->ns != NULL) && (cur->ns->prefix != NULL))
|
||||
+ qnameLen += xmlStrlen(cur->ns->prefix) + 1;
|
||||
+ if (size - len < qnameLen + 10) {
|
||||
+ if ((size - len > 4) && (buf[len - 1] != '.'))
|
||||
+ strcat(buf, " ...");
|
||||
+ return;
|
||||
+ }
|
||||
if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
|
||||
- if (size - len < xmlStrlen(cur->ns->prefix) + 10) {
|
||||
- if ((size - len > 4) && (buf[len - 1] != '.'))
|
||||
- strcat(buf, " ...");
|
||||
- return;
|
||||
- }
|
||||
strcat(buf, (char *) cur->ns->prefix);
|
||||
strcat(buf, ":");
|
||||
}
|
||||
- if (size - len < xmlStrlen(cur->name) + 10) {
|
||||
- if ((size - len > 4) && (buf[len - 1] != '.'))
|
||||
- strcat(buf, " ...");
|
||||
- return;
|
||||
- }
|
||||
- strcat(buf, (char *) cur->name);
|
||||
+ if (cur->name != NULL)
|
||||
+ strcat(buf, (char *) cur->name);
|
||||
if (cur->next != NULL)
|
||||
strcat(buf, " ");
|
||||
break;
|
||||
+ }
|
||||
case XML_TEXT_NODE:
|
||||
if (xmlIsBlankNode(cur))
|
||||
break;
|
||||
--
|
||||
GitLab
|
||||
|
||||
31
backport-CVE-2025-27113.patch
Normal file
31
backport-CVE-2025-27113.patch
Normal file
@ -0,0 +1,31 @@
|
||||
From 503f788e84f1c1f1d769c2c7258d77faee94b5a3 Mon Sep 17 00:00:00 2001
|
||||
From: Nick Wellnhofer <wellnhofer@aevum.de>
|
||||
Date: Thu, 13 Feb 2025 16:48:53 +0100
|
||||
Subject: [PATCH] pattern: Fix compilation of explicit child axis
|
||||
|
||||
The child axis is the default axis and should generate XML_OP_ELEM like
|
||||
the case without an axis.
|
||||
---
|
||||
pattern.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/pattern.c b/pattern.c
|
||||
index 55ae2d3e5..b0f7f1601 100644
|
||||
--- a/pattern.c
|
||||
+++ b/pattern.c
|
||||
@@ -1164,10 +1164,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) {
|
||||
goto error;
|
||||
}
|
||||
} else {
|
||||
- PUSH(XML_OP_CHILD, token, URL);
|
||||
+ PUSH(XML_OP_ELEM, token, URL);
|
||||
}
|
||||
} else
|
||||
- PUSH(XML_OP_CHILD, name, NULL);
|
||||
+ PUSH(XML_OP_ELEM, name, NULL);
|
||||
return;
|
||||
} else if (xmlStrEqual(name, (const xmlChar *) "attribute")) {
|
||||
XML_PAT_FREE_STRING(ctxt, name)
|
||||
--
|
||||
GitLab
|
||||
|
||||
13
libxml2.spec
13
libxml2.spec
@ -1,7 +1,7 @@
|
||||
Summary: Library providing XML and HTML support
|
||||
Name: libxml2
|
||||
Version: 2.11.5
|
||||
Release: 4
|
||||
Release: 5
|
||||
License: MIT
|
||||
Group: Development/Libraries
|
||||
Source: https://download.gnome.org/sources/%{name}/2.11/%{name}-%{version}.tar.xz
|
||||
@ -13,6 +13,9 @@ Patch3: backport-examples-Don-t-call-xmlCleanupParser-and-xmlMemoryDu.patch
|
||||
Patch4: backport-CVE-2024-25062.patch
|
||||
Patch5: backport-CVE-2024-34459.patch
|
||||
Patch6: backport-CVE-2024-40896.patch
|
||||
Patch7: backport-CVE-2024-56171.patch
|
||||
Patch8: backport-CVE-2025-24928.patch
|
||||
Patch9: backport-CVE-2025-27113.patch
|
||||
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-root
|
||||
BuildRequires: python3-devel
|
||||
@ -164,6 +167,14 @@ rm -fr %{buildroot}
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Feb 19 2025 Funda Wang <fundawang@yeah.net> - 2.11.5-5
|
||||
- Type:CVE
|
||||
- CVE:CVE-2024-56171
|
||||
- CVE:CVE-2025-24928
|
||||
- CVE:CVE-2025-27113
|
||||
- SUG:NA
|
||||
- DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113
|
||||
|
||||
* Mon Jul 29 2024 Funda Wang <fundawang@yeah.net> - 2.11.5-4
|
||||
- Type:CVE
|
||||
- CVE:CVE-2024-40896
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user