Skip to content

Commit 05aca83

Browse files
[AUTO-CHERRYPICK] libxml2: Fix CVE-2023-45322 and CVE-2024-34459 - branch 3.0-dev (#12082)
Co-authored-by: KavyaSree2610 <92566732+KavyaSree2610@users.noreply.github.com>
1 parent d2bdfd8 commit 05aca83

7 files changed

Lines changed: 118 additions & 13 deletions

File tree

SPECS/libxml2/CVE-2023-45322.patch

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
From d39f78069dff496ec865c73aa44d7110e429bce9 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Wed, 23 Aug 2023 20:24:24 +0200
4+
Subject: [PATCH] tree: Fix copying of DTDs
5+
6+
- Don't create multiple DTD nodes.
7+
- Fix UAF if malloc fails.
8+
- Skip DTD nodes if tree module is disabled.
9+
10+
Fixes #583.
11+
---
12+
tree.c | 31 ++++++++++++++++---------------
13+
1 file changed, 16 insertions(+), 15 deletions(-)
14+
15+
diff --git a/tree.c b/tree.c
16+
index 6c8a875b9..02c1b5791 100644
17+
--- a/tree.c
18+
+++ b/tree.c
19+
@@ -4471,29 +4471,28 @@ xmlNodePtr
20+
xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
21+
xmlNodePtr ret = NULL;
22+
xmlNodePtr p = NULL,q;
23+
+ xmlDtdPtr newSubset = NULL;
24+
25+
while (node != NULL) {
26+
-#ifdef LIBXML_TREE_ENABLED
27+
if (node->type == XML_DTD_NODE ) {
28+
- if (doc == NULL) {
29+
+#ifdef LIBXML_TREE_ENABLED
30+
+ if ((doc == NULL) || (doc->intSubset != NULL)) {
31+
node = node->next;
32+
continue;
33+
}
34+
- if (doc->intSubset == NULL) {
35+
- q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
36+
- if (q == NULL) goto error;
37+
- q->doc = doc;
38+
- q->parent = parent;
39+
- doc->intSubset = (xmlDtdPtr) q;
40+
- xmlAddChild(parent, q);
41+
- } else {
42+
- q = (xmlNodePtr) doc->intSubset;
43+
- xmlAddChild(parent, q);
44+
- }
45+
- } else
46+
+ q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
47+
+ if (q == NULL) goto error;
48+
+ q->doc = doc;
49+
+ q->parent = parent;
50+
+ newSubset = (xmlDtdPtr) q;
51+
+#else
52+
+ node = node->next;
53+
+ continue;
54+
#endif /* LIBXML_TREE_ENABLED */
55+
+ } else {
56+
q = xmlStaticCopyNode(node, doc, parent, 1);
57+
- if (q == NULL) goto error;
58+
+ if (q == NULL) goto error;
59+
+ }
60+
if (ret == NULL) {
61+
q->prev = NULL;
62+
ret = p = q;
63+
@@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
64+
}
65+
node = node->next;
66+
}
67+
+ if (newSubset != NULL)
68+
+ doc->intSubset = newSubset;
69+
return(ret);
70+
error:
71+
xmlFreeNodeList(ret);
72+
--
73+
GitLab
74+

SPECS/libxml2/CVE-2024-34459.patch

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 8ddc7f13337c9fe7c6b6e616f404b0fffb8a5145 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Wed, 8 May 2024 11:49:31 +0200
4+
Subject: [PATCH] [CVE-2024-34459] Fix buffer overread with `xmllint --htmlout`
5+
6+
Add a missing bounds check.
7+
---
8+
xmllint.c | 2 +-
9+
1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+
diff --git a/xmllint.c b/xmllint.c
12+
index 0e433b721..62f6b0273 100644
13+
--- a/xmllint.c
14+
+++ b/xmllint.c
15+
@@ -559,7 +559,7 @@ xmlHTMLPrintFileContext(xmlParserInputPtr input) {
16+
len = strlen(buffer);
17+
snprintf(&buffer[len], sizeof(buffer) - len, "\n");
18+
cur = input->cur;
19+
- while ((*cur == '\n') || (*cur == '\r'))
20+
+ while ((cur > base) && ((*cur == '\n') || (*cur == '\r')))
21+
cur--;
22+
n = 0;
23+
while ((cur != base) && (n++ < 80)) {
24+
--
25+
GitLab
26+

SPECS/libxml2/libxml2.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.11.5
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: System Environment/General Libraries
99
URL: https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home
1010
Source0: https://gitlab.gnome.org/GNOME/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz
1111
Patch0: CVE-2024-40896.patch
12+
Patch1: CVE-2023-45322.patch
13+
Patch2: CVE-2024-34459.patch
1214
BuildRequires: python3-devel
1315
BuildRequires: python3-xml
1416
Provides: %{name}-tools = %{version}-%{release}
@@ -79,6 +81,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
7981
%{_libdir}/cmake/libxml2/libxml2-config.cmake
8082

8183
%changelog
84+
* Fri Jan 24 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> -2.11.5-3
85+
- Fix CVE-2023-45322 & CVE-2024-34459
86+
8287
* Thu Dec 26 2024 Muhammad Falak <mwani@microsoft.com> - 2.11.5-2
8388
- Patch CVE-2024-40896
8489

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,8 @@ curl-8.8.0-3.azl3.aarch64.rpm
199199
curl-devel-8.8.0-3.azl3.aarch64.rpm
200200
curl-libs-8.8.0-3.azl3.aarch64.rpm
201201
createrepo_c-1.0.3-1.azl3.aarch64.rpm
202-
libxml2-2.11.5-2.azl3.aarch64.rpm
203-
libxml2-devel-2.11.5-2.azl3.aarch64.rpm
202+
libxml2-2.11.5-3.azl3.aarch64.rpm
203+
libxml2-devel-2.11.5-3.azl3.aarch64.rpm
204204
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
205205
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
206206
libsepol-3.6-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,8 @@ curl-8.8.0-3.azl3.x86_64.rpm
199199
curl-devel-8.8.0-3.azl3.x86_64.rpm
200200
curl-libs-8.8.0-3.azl3.x86_64.rpm
201201
createrepo_c-1.0.3-1.azl3.x86_64.rpm
202-
libxml2-2.11.5-2.azl3.x86_64.rpm
203-
libxml2-devel-2.11.5-2.azl3.x86_64.rpm
202+
libxml2-2.11.5-3.azl3.x86_64.rpm
203+
libxml2-devel-2.11.5-3.azl3.x86_64.rpm
204204
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
205205
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
206206
libsepol-3.6-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -240,9 +240,9 @@ libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
240240
libxcrypt-4.4.36-2.azl3.aarch64.rpm
241241
libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm
242242
libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
243-
libxml2-2.11.5-2.azl3.aarch64.rpm
244-
libxml2-debuginfo-2.11.5-2.azl3.aarch64.rpm
245-
libxml2-devel-2.11.5-2.azl3.aarch64.rpm
243+
libxml2-2.11.5-3.azl3.aarch64.rpm
244+
libxml2-debuginfo-2.11.5-3.azl3.aarch64.rpm
245+
libxml2-devel-2.11.5-3.azl3.aarch64.rpm
246246
libxslt-1.1.39-1.azl3.aarch64.rpm
247247
libxslt-debuginfo-1.1.39-1.azl3.aarch64.rpm
248248
libxslt-devel-1.1.39-1.azl3.aarch64.rpm
@@ -541,7 +541,7 @@ python3-gpg-1.23.2-2.azl3.aarch64.rpm
541541
python3-jinja2-3.1.2-2.azl3.noarch.rpm
542542
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
543543
python3-libs-3.12.3-5.azl3.aarch64.rpm
544-
python3-libxml2-2.11.5-2.azl3.aarch64.rpm
544+
python3-libxml2-2.11.5-3.azl3.aarch64.rpm
545545
python3-lxml-4.9.3-1.azl3.aarch64.rpm
546546
python3-magic-5.45-1.azl3.noarch.rpm
547547
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,9 +245,9 @@ libtasn1-debuginfo-4.19.0-1.azl3.x86_64.rpm
245245
libtasn1-devel-4.19.0-1.azl3.x86_64.rpm
246246
libtool-2.4.7-1.azl3.x86_64.rpm
247247
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
248-
libxml2-2.11.5-2.azl3.x86_64.rpm
249-
libxml2-debuginfo-2.11.5-2.azl3.x86_64.rpm
250-
libxml2-devel-2.11.5-2.azl3.x86_64.rpm
248+
libxml2-2.11.5-3.azl3.x86_64.rpm
249+
libxml2-debuginfo-2.11.5-3.azl3.x86_64.rpm
250+
libxml2-devel-2.11.5-3.azl3.x86_64.rpm
251251
libxcrypt-4.4.36-2.azl3.x86_64.rpm
252252
libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm
253253
libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm
@@ -549,7 +549,7 @@ python3-gpg-1.23.2-2.azl3.x86_64.rpm
549549
python3-jinja2-3.1.2-2.azl3.noarch.rpm
550550
python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm
551551
python3-libs-3.12.3-5.azl3.x86_64.rpm
552-
python3-libxml2-2.11.5-2.azl3.x86_64.rpm
552+
python3-libxml2-2.11.5-3.azl3.x86_64.rpm
553553
python3-lxml-4.9.3-1.azl3.x86_64.rpm
554554
python3-magic-5.45-1.azl3.noarch.rpm
555555
python3-markupsafe-2.1.3-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)