Browse code
Fix CVE-2017-8872 in libxml2
Change-Id: Ieec23df157aeaf9e0f3f89b02e0664aa6bbf304a
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3472
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
DheerajSShetty authored on 2017/08/10 08:40:34Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,14 @@ |
| 0 |
+diff -dupr a/parser.c b/parser.c |
|
| 1 |
+--- a/parser.c 2016-05-23 00:25:25.000000000 -0700 |
|
| 2 |
+@@ -12714,6 +12714,10 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) {
|
|
| 3 |
+ } |
|
| 4 |
+ ctxt->input->cur = BAD_CAST""; |
|
| 5 |
+ ctxt->input->base = ctxt->input->cur; |
|
| 6 |
++ if (ctxt->input->buf) {
|
|
| 7 |
++ xmlBufEmpty (ctxt->input->buf->buffer); |
|
| 8 |
++ } else |
|
| 9 |
++ ctxt->input->length = 0; |
|
| 10 |
+ } |
|
| 11 |
+ } |
|
| 12 |
+ |
| ... | ... |
@@ -4,7 +4,7 @@ |
| 4 | 4 |
Summary: Libxml2 |
| 5 | 5 |
Name: libxml2 |
| 6 | 6 |
Version: 2.9.4 |
| 7 |
-Release: 6%{?dist}
|
|
| 7 |
+Release: 7%{?dist}
|
|
| 8 | 8 |
License: MIT |
| 9 | 9 |
URL: http://xmlsoft.org/ |
| 10 | 10 |
Group: System Environment/General Libraries |
| ... | ... |
@@ -20,6 +20,8 @@ Patch2: cve-2016-9318.patch |
| 20 | 20 |
Patch3: libxml2-fix-buffer-size-checks.patch |
| 21 | 21 |
# Fix for CVE-2017-9049 and CVE-2017-9050 |
| 22 | 22 |
Patch4: libxml2-fix-handling-of-parameter-entity-references.patch |
| 23 |
+# Patch from https://bugzilla.gnome.org/attachment.cgi?id=355527&action=diff#libxml2-2.9.4/parser.c_sec1 |
|
| 24 |
+Patch5: CVE-2017-8872.patch |
|
| 23 | 25 |
%define sha1 libxml2=958ae70baf186263a4bd801a81dd5d682aedd1db |
| 24 | 26 |
Provides: pkgconfig(libxml-2.0) |
| 25 | 27 |
|
| ... | ... |
@@ -63,6 +65,7 @@ Static libraries and header files for the support library for libxml |
| 63 | 63 |
%patch2 -p1 |
| 64 | 64 |
%patch3 -p1 |
| 65 | 65 |
%patch4 -p1 |
| 66 |
+%patch5 -p1 |
|
| 66 | 67 |
sed \ |
| 67 | 68 |
-e /xmlInitializeCatalog/d \ |
| 68 | 69 |
-e 's/((ent->checked =.*&&/(((ent->checked == 0) ||\ |
| ... | ... |
@@ -126,6 +129,8 @@ rm -rf %{buildroot}/*
|
| 126 | 126 |
|
| 127 | 127 |
|
| 128 | 128 |
%changelog |
| 129 |
+* Wed Aug 09 2017 Dheeraj Shetty <dheerajs@vmware.com> 2.9.4-7 |
|
| 130 |
+- Apply patch for CVE-2017-8872 |
|
| 129 | 131 |
* Mon Jul 10 2017 Divya Thaluru <dthaluru@vmware.com> 2.9.4-6 |
| 130 | 132 |
- Apply patch for CVE-2017-9047, CVE-2017-9048, CVE-2017-9049 and CVE-2017-9050 |
| 131 | 133 |
* Thu May 18 2017 Xiaolin Li <xiaolinl@vmware.com> 2.9.4-5 |