Skip to content

Commit 5301a0b

Browse files
CBL-Mariner-BotKanishk-Bansal
CBL-Mariner-Bot
and
Kanishk-Bansal
authored
[AUTO-CHERRYPICK] Patch libxml2 for CVE-2025-24928, CVE-2024-56171, CVE-2025-27113 & CVE-2024-25062 [High] - branch 3.0-dev (#12580)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent f61404b commit 5301a0b

9 files changed

Lines changed: 172 additions & 16 deletions

File tree

‎SPECS/libxml2/CVE-2024-25062.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 2b0aac140d739905c7848a42efc60bfe783a39b7 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Sat, 14 Oct 2023 22:45:54 +0200
4+
Subject: [PATCH] [CVE-2024-25062] xmlreader: Don't expand XIncludes when
5+
backtracking
6+
7+
Fixes a use-after-free if XML Reader if used with DTD validation and
8+
XInclude expansion.
9+
10+
Fixes #604.
11+
---
12+
xmlreader.c | 1 +
13+
1 file changed, 1 insertion(+)
14+
15+
diff --git a/xmlreader.c b/xmlreader.c
16+
index 979385a13..fefd68e0b 100644
17+
--- a/xmlreader.c
18+
+++ b/xmlreader.c
19+
@@ -1443,6 +1443,7 @@ xmlTextReaderRead(xmlTextReaderPtr reader) {
20+
* Handle XInclude if asked for
21+
*/
22+
if ((reader->xinclude) && (reader->in_xinclude == 0) &&
23+
+ (reader->state != XML_TEXTREADER_BACKTRACK) &&
24+
(reader->node != NULL) &&
25+
(reader->node->type == XML_ELEMENT_NODE) &&
26+
(reader->node->ns != NULL) &&

‎SPECS/libxml2/CVE-2024-56171.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 5880a9a6bd97c0f9ac8fc4f30110fe023f484746 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Tue, 10 Dec 2024 16:52:05 +0100
4+
Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after
5+
xmlSchemaItemListAdd
6+
7+
xmlSchemaItemListAdd can reallocate the items array. Update local
8+
variables after adding item in
9+
10+
- xmlSchemaIDCFillNodeTables
11+
- xmlSchemaBubbleIDCNodeTables
12+
13+
Fixes #828.
14+
---
15+
xmlschemas.c | 3 +++
16+
1 file changed, 3 insertions(+)
17+
18+
diff --git a/xmlschemas.c b/xmlschemas.c
19+
index 1b3c524f2..95be97c96 100644
20+
--- a/xmlschemas.c
21+
+++ b/xmlschemas.c
22+
@@ -23374,6 +23374,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
23+
}
24+
if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1)
25+
goto internal_error;
26+
+ dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items;
27+
/*
28+
* Remove the duplicate entry from the IDC node-table.
29+
*/
30+
@@ -23590,6 +23591,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt)
31+
goto internal_error;
32+
}
33+
xmlSchemaItemListAdd(parBind->dupls, parNode);
34+
+ dupls = (xmlSchemaPSVIIDCNodePtr *)
35+
+ parBind->dupls->items;
36+
} else {
37+
/*
38+
* Add the node-table entry (node and key-sequence) of

‎SPECS/libxml2/CVE-2025-24928.patch‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
From 29f5d2b67e31c435cbc08954a12a0267c5887d39 Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <kbkanishk975@gmail.com>
3+
Date: Sat, 22 Feb 2025 18:12:41 +0000
4+
Subject: [PATCH] CVE-2025-24928
5+
6+
Upstream Reference: https://github.com/GNOME/libxml2/commit/8c8753ad5280ee13aee5eec9b0f6eee2ed920f57
7+
8+
---
9+
valid.c | 25 +++++++++++++------------
10+
1 file changed, 13 insertions(+), 12 deletions(-)
11+
12+
diff --git a/valid.c b/valid.c
13+
index 67e1b1d..7eb2dd3 100644
14+
--- a/valid.c
15+
+++ b/valid.c
16+
@@ -5252,25 +5252,26 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
17+
return;
18+
}
19+
switch (cur->type) {
20+
- case XML_ELEMENT_NODE:
21+
+ case XML_ELEMENT_NODE: {
22+
+ int qnameLen = xmlStrlen(cur->name);
23+
+
24+
+ if ((cur->ns != NULL) && (cur->ns->prefix != NULL))
25+
+ qnameLen += xmlStrlen(cur->ns->prefix) + 1;
26+
+ if (size - len < qnameLen + 10) {
27+
+ if ((size - len > 4) && (buf[len - 1] != '.'))
28+
+ strcat(buf, " ...");
29+
+ return;
30+
+ }
31+
if ((cur->ns != NULL) && (cur->ns->prefix != NULL)) {
32+
- if (size - len < xmlStrlen(cur->ns->prefix) + 10) {
33+
- if ((size - len > 4) && (buf[len - 1] != '.'))
34+
- strcat(buf, " ...");
35+
- return;
36+
- }
37+
strcat(buf, (char *) cur->ns->prefix);
38+
strcat(buf, ":");
39+
}
40+
- if (size - len < xmlStrlen(cur->name) + 10) {
41+
- if ((size - len > 4) && (buf[len - 1] != '.'))
42+
- strcat(buf, " ...");
43+
- return;
44+
- }
45+
- strcat(buf, (char *) cur->name);
46+
+ if (cur->name != NULL)
47+
+ strcat(buf, (char *) cur->name);
48+
if (cur->next != NULL)
49+
strcat(buf, " ");
50+
break;
51+
+ }
52+
case XML_TEXT_NODE:
53+
if (xmlIsBlankNode(cur))
54+
break;
55+
--
56+
2.45.2
57+

‎SPECS/libxml2/CVE-2025-27113.patch‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From 6c716d491dd2e67f08066f4dc0619efeb49e43e6 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Thu, 13 Feb 2025 16:48:53 +0100
4+
Subject: [PATCH] pattern: Fix compilation of explicit child axis
5+
6+
The child axis is the default axis and should generate XML_OP_ELEM like
7+
the case without an axis.
8+
---
9+
pattern.c | 4 ++--
10+
1 file changed, 2 insertions(+), 2 deletions(-)
11+
12+
diff --git a/pattern.c b/pattern.c
13+
index 0877fc1a0..6fa88f759 100644
14+
--- a/pattern.c
15+
+++ b/pattern.c
16+
@@ -1035,10 +1035,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) {
17+
goto error;
18+
}
19+
} else {
20+
- PUSH(XML_OP_CHILD, token, URL);
21+
+ PUSH(XML_OP_ELEM, token, URL);
22+
}
23+
} else
24+
- PUSH(XML_OP_CHILD, name, NULL);
25+
+ PUSH(XML_OP_ELEM, name, NULL);
26+
return;
27+
} else if (xmlStrEqual(name, (const xmlChar *) "attribute")) {
28+
XML_PAT_FREE_STRING(ctxt, name)

‎SPECS/libxml2/libxml2.spec‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,20 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.11.5
4-
Release: 3%{?dist}
4+
Release: 4%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: System Environment/General Libraries
99
URL: https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home
1010
Source0: https://gitlab.gnome.org/GNOME/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz
1111
Patch0: CVE-2024-40896.patch
12-
Patch1: CVE-2023-45322.patch
13-
Patch2: CVE-2024-34459.patch
12+
Patch1: CVE-2023-45322.patch
13+
Patch2: CVE-2024-34459.patch
14+
Patch3: CVE-2024-56171.patch
15+
Patch4: CVE-2025-24928.patch
16+
Patch5: CVE-2024-25062.patch
17+
Patch6: CVE-2025-27113.patch
1418
BuildRequires: python3-devel
1519
BuildRequires: python3-xml
1620
Provides: %{name}-tools = %{version}-%{release}
@@ -81,7 +85,10 @@ find %{buildroot} -type f -name "*.la" -delete -print
8185
%{_libdir}/cmake/libxml2/libxml2-config.cmake
8286

8387
%changelog
84-
* Fri Jan 24 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> -2.11.5-3
88+
* Sat Feb 22 2025 Kanishk Bansal <kanbansal@microsoft.com> - 2.11.5-4
89+
- Patch CVE-2025-24928, CVE-2024-56171, CVE-2024-25062, CVE-2025-27113
90+
91+
* Fri Jan 24 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 2.11.5-3
8592
- Fix CVE-2023-45322 & CVE-2024-34459
8693

8794
* Thu Dec 26 2024 Muhammad Falak <mwani@microsoft.com> - 2.11.5-2

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-1.azl3.aarch64.rpm
203203
curl-devel-8.11.1-1.azl3.aarch64.rpm
204204
curl-libs-8.11.1-1.azl3.aarch64.rpm
205205
createrepo_c-1.0.3-1.azl3.aarch64.rpm
206-
libxml2-2.11.5-3.azl3.aarch64.rpm
207-
libxml2-devel-2.11.5-3.azl3.aarch64.rpm
206+
libxml2-2.11.5-4.azl3.aarch64.rpm
207+
libxml2-devel-2.11.5-4.azl3.aarch64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-1.azl3.x86_64.rpm
203203
curl-devel-8.11.1-1.azl3.x86_64.rpm
204204
curl-libs-8.11.1-1.azl3.x86_64.rpm
205205
createrepo_c-1.0.3-1.azl3.x86_64.rpm
206-
libxml2-2.11.5-3.azl3.x86_64.rpm
207-
libxml2-devel-2.11.5-3.azl3.x86_64.rpm
206+
libxml2-2.11.5-4.azl3.x86_64.rpm
207+
libxml2-devel-2.11.5-4.azl3.x86_64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-1.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -240,9 +240,9 @@ libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
240240
libxcrypt-4.4.36-2.azl3.aarch64.rpm
241241
libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm
242242
libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
243-
libxml2-2.11.5-3.azl3.aarch64.rpm
244-
libxml2-debuginfo-2.11.5-3.azl3.aarch64.rpm
245-
libxml2-devel-2.11.5-3.azl3.aarch64.rpm
243+
libxml2-2.11.5-4.azl3.aarch64.rpm
244+
libxml2-debuginfo-2.11.5-4.azl3.aarch64.rpm
245+
libxml2-devel-2.11.5-4.azl3.aarch64.rpm
246246
libxslt-1.1.39-1.azl3.aarch64.rpm
247247
libxslt-debuginfo-1.1.39-1.azl3.aarch64.rpm
248248
libxslt-devel-1.1.39-1.azl3.aarch64.rpm
@@ -541,7 +541,7 @@ python3-gpg-1.23.2-2.azl3.aarch64.rpm
541541
python3-jinja2-3.1.2-2.azl3.noarch.rpm
542542
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
543543
python3-libs-3.12.3-6.azl3.aarch64.rpm
544-
python3-libxml2-2.11.5-3.azl3.aarch64.rpm
544+
python3-libxml2-2.11.5-4.azl3.aarch64.rpm
545545
python3-lxml-4.9.3-1.azl3.aarch64.rpm
546546
python3-magic-5.45-1.azl3.noarch.rpm
547547
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,9 +245,9 @@ libtasn1-debuginfo-4.19.0-1.azl3.x86_64.rpm
245245
libtasn1-devel-4.19.0-1.azl3.x86_64.rpm
246246
libtool-2.4.7-1.azl3.x86_64.rpm
247247
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
248-
libxml2-2.11.5-3.azl3.x86_64.rpm
249-
libxml2-debuginfo-2.11.5-3.azl3.x86_64.rpm
250-
libxml2-devel-2.11.5-3.azl3.x86_64.rpm
248+
libxml2-2.11.5-4.azl3.x86_64.rpm
249+
libxml2-debuginfo-2.11.5-4.azl3.x86_64.rpm
250+
libxml2-devel-2.11.5-4.azl3.x86_64.rpm
251251
libxcrypt-4.4.36-2.azl3.x86_64.rpm
252252
libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm
253253
libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm
@@ -549,7 +549,7 @@ python3-gpg-1.23.2-2.azl3.x86_64.rpm
549549
python3-jinja2-3.1.2-2.azl3.noarch.rpm
550550
python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm
551551
python3-libs-3.12.3-6.azl3.x86_64.rpm
552-
python3-libxml2-2.11.5-3.azl3.x86_64.rpm
552+
python3-libxml2-2.11.5-4.azl3.x86_64.rpm
553553
python3-lxml-4.9.3-1.azl3.x86_64.rpm
554554
python3-magic-5.45-1.azl3.noarch.rpm
555555
python3-markupsafe-2.1.3-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)