From: Alexander Dahl <ada@thorsis.com>
To: ptxdist@pengutronix.de
Cc: Denis OSTERLAND <denis.osterland@diehl.com>
Subject: [ptxdist] [PATCH] libxml2: version bump 2.9.7 -> 2.9.9
Date: Wed, 20 Feb 2019 14:09:52 +0100 [thread overview]
Message-ID: <20190220130952.8334-1-ada@thorsis.com> (raw)
Includes bug fixes and fixes for CVE-2018-9251, CVE-2018-14567, and
CVE-2018-14404.
The patch for CVE-2017-8872 was removed. Although there's nothing about
that in the changelogs, the underlying problem was solved with 2.9.9:
https://mail.gnome.org/archives/xml/2019-January/msg00011.html
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---
...ut-of-bounds-read-in-htmlParseTryOrFinish.patch | 31 ----------------------
.../0200-xml2-config-is-not-SYSROOT-aware.patch | 0
patches/{libxml2-2.9.7 => libxml2-2.9.9}/series | 4 +--
rules/libxml2.make | 4 +--
4 files changed, 3 insertions(+), 36 deletions(-)
delete mode 100644 patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch
rename patches/{libxml2-2.9.7 => libxml2-2.9.9}/0200-xml2-config-is-not-SYSROOT-aware.patch (100%)
rename patches/{libxml2-2.9.7 => libxml2-2.9.9}/series (47%)
diff --git a/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch b/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch
deleted file mode 100644
index c23cb47e5..000000000
--- a/patches/libxml2-2.9.7/0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Marcus Meissner <meissner@suse.de>
-Date: Wed, 3 Jan 2018 14:43:41 +0100
-Subject: [PATCH] Out-of-bounds read in htmlParseTryOrFinish
-
-Origin: vendor, https://bugzilla.novell.com/attachment.cgi?id=732309
-Bug: https://bugzilla.gnome.org/show_bug.cgi?id=775200
-Bug-Debian: https://bugs.debian.org/862450
-Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-8872
-Bug-SUSE: https://bugzilla.novell.com/show_bug.cgi?id=1038444
-Forwarded: yes, https://bugzilla.gnome.org/attachment.cgi?id=366193
-Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
-Last-Update: 2018-01-03
----
- parser.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/parser.c b/parser.c
-index 1c5e036ea265..025111067ae8 100644
---- a/parser.c
-+++ b/parser.c
-@@ -12467,6 +12467,10 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) {
- ctxt->input->cur = BAD_CAST"";
- ctxt->input->base = ctxt->input->cur;
- ctxt->input->end = ctxt->input->cur;
-+ if (ctxt->input->buf)
-+ xmlBufEmpty (ctxt->input->buf->buffer);
-+ else
-+ ctxt->input->length = 0;
- }
- }
-
diff --git a/patches/libxml2-2.9.7/0200-xml2-config-is-not-SYSROOT-aware.patch b/patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
similarity index 100%
rename from patches/libxml2-2.9.7/0200-xml2-config-is-not-SYSROOT-aware.patch
rename to patches/libxml2-2.9.9/0200-xml2-config-is-not-SYSROOT-aware.patch
diff --git a/patches/libxml2-2.9.7/series b/patches/libxml2-2.9.9/series
similarity index 47%
rename from patches/libxml2-2.9.7/series
rename to patches/libxml2-2.9.9/series
index 07fceed7b..198075fbf 100644
--- a/patches/libxml2-2.9.7/series
+++ b/patches/libxml2-2.9.9/series
@@ -1,7 +1,5 @@
# generated by git-ptx-patches
#tag:base --start-number 1
-#tag:debian --start-number 100
-0100-Out-of-bounds-read-in-htmlParseTryOrFinish.patch
#tag:ptx --start-number 200
0200-xml2-config-is-not-SYSROOT-aware.patch
-# 5b451bf42a96789ecd1e84388af58f95 - git-ptx-patches magic
+# 9a7de85eef8cb30919e83bc9b2e42cd9 - git-ptx-patches magic
diff --git a/rules/libxml2.make b/rules/libxml2.make
index ab8c6f561..234e85f3e 100644
--- a/rules/libxml2.make
+++ b/rules/libxml2.make
@@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_LIBXML2) += libxml2
#
# Paths and names
#
-LIBXML2_VERSION := 2.9.7
-LIBXML2_MD5 := 896608641a08b465098a40ddf51cefba
+LIBXML2_VERSION := 2.9.9
+LIBXML2_MD5 := c04a5a0a042eaa157e8e8c9eabe76bd6
LIBXML2 := libxml2-$(LIBXML2_VERSION)
LIBXML2_SUFFIX := tar.gz
LIBXML2_SOURCE := $(SRCDIR)/$(LIBXML2).$(LIBXML2_SUFFIX)
--
2.11.0
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
reply other threads:[~2019-02-20 13:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190220130952.8334-1-ada@thorsis.com \
--to=ada@thorsis.com \
--cc=denis.osterland@diehl.com \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox