Skip to content

Commit 55b53eb

Browse files
azurelinux-securityakhila-gurujuKanishk-Bansal
authored
[AutoPR- Security] Patch libxml2 for CVE-2026-0990, CVE-2026-0992, CVE-2025-8732 [MEDIUM] (#15529)
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 1b2fc1b commit 55b53eb

8 files changed

Lines changed: 325 additions & 13 deletions

File tree

‎SPECS/libxml2/CVE-2025-8732.patch‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
From c8e11a7d05946bf69d835adafa8ad98dad0c5e74 Mon Sep 17 00:00:00 2001
2+
From: Nathan <nathan.shain@echohq.com>
3+
Date: Wed, 10 Sep 2025 18:11:50 +0300
4+
Subject: [PATCH] fix: Prevent infinite recursion in xmlCatalogListXMLResolve
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
7+
Upstream-reference: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/337.patch
8+
---
9+
catalog.c | 28 ++++++++++++++++++++--------
10+
result/catalogs/recursive | 1 +
11+
test/catalogs/recursive.script | 0
12+
test/catalogs/recursive.sgml | 1 +
13+
4 files changed, 22 insertions(+), 8 deletions(-)
14+
create mode 100644 result/catalogs/recursive
15+
create mode 100644 test/catalogs/recursive.script
16+
create mode 100644 test/catalogs/recursive.sgml
17+
18+
diff --git a/catalog.c b/catalog.c
19+
index 3886d84..eaa2a5f 100644
20+
--- a/catalog.c
21+
+++ b/catalog.c
22+
@@ -84,7 +84,7 @@ unsigned long __stdcall GetModuleFileNameA(void*, char*, unsigned long);
23+
#endif
24+
25+
static xmlChar *xmlCatalogNormalizePublic(const xmlChar *pubID);
26+
-static int xmlExpandCatalog(xmlCatalogPtr catal, const char *filename);
27+
+static int xmlExpandCatalog(xmlCatalogPtr catal, const char *filename, int depth);
28+
29+
/************************************************************************
30+
* *
31+
@@ -2351,17 +2351,24 @@ xmlGetSGMLCatalogEntryType(const xmlChar *name) {
32+
* Parse an SGML catalog content and fill up the @catal hash table with
33+
* the new entries found.
34+
*
35+
+ * @param depth the current depth of the catalog
36+
* Returns 0 in case of success, -1 in case of error.
37+
*/
38+
static int
39+
xmlParseSGMLCatalog(xmlCatalogPtr catal, const xmlChar *value,
40+
- const char *file, int super) {
41+
+ const char *file, int super, int depth) {
42+
const xmlChar *cur = value;
43+
xmlChar *base = NULL;
44+
int res;
45+
46+
if ((cur == NULL) || (file == NULL))
47+
return(-1);
48+
+
49+
+ /* Check recursion depth */
50+
+ if (depth > MAX_CATAL_DEPTH) {
51+
+ return(-1);
52+
+ }
53+
+
54+
base = xmlStrdup((const xmlChar *) file);
55+
56+
while ((cur != NULL) && (cur[0] != 0)) {
57+
@@ -2539,7 +2546,7 @@ xmlParseSGMLCatalog(xmlCatalogPtr catal, const xmlChar *value,
58+
59+
filename = xmlBuildURI(sysid, base);
60+
if (filename != NULL) {
61+
- xmlExpandCatalog(catal, (const char *)filename);
62+
+ xmlExpandCatalog(catal, (const char *)filename, depth);
63+
xmlFree(filename);
64+
}
65+
}
66+
@@ -2689,7 +2696,7 @@ xmlLoadSGMLSuperCatalog(const char *filename)
67+
return(NULL);
68+
}
69+
70+
- ret = xmlParseSGMLCatalog(catal, content, filename, 1);
71+
+ ret = xmlParseSGMLCatalog(catal, content, filename, 1, 0);
72+
xmlFree(content);
73+
if (ret < 0) {
74+
xmlFreeCatalog(catal);
75+
@@ -2735,7 +2742,7 @@ xmlLoadACatalog(const char *filename)
76+
xmlFree(content);
77+
return(NULL);
78+
}
79+
- ret = xmlParseSGMLCatalog(catal, content, filename, 0);
80+
+ ret = xmlParseSGMLCatalog(catal, content, filename, 0, 0);
81+
if (ret < 0) {
82+
xmlFreeCatalog(catal);
83+
xmlFree(content);
84+
@@ -2762,16 +2769,21 @@ xmlLoadACatalog(const char *filename)
85+
* Load the catalog and expand the existing catal structure.
86+
* This can be either an XML Catalog or an SGML Catalog
87+
*
88+
+ * @param depth the current depth of the catalog
89+
* Returns 0 in case of success, -1 in case of error
90+
*/
91+
static int
92+
-xmlExpandCatalog(xmlCatalogPtr catal, const char *filename)
93+
+xmlExpandCatalog(xmlCatalogPtr catal, const char *filename, int depth)
94+
{
95+
int ret;
96+
97+
if ((catal == NULL) || (filename == NULL))
98+
return(-1);
99+
100+
+ /* Check recursion depth */
101+
+ if (depth > MAX_CATAL_DEPTH) {
102+
+ return(-1);
103+
+ }
104+
105+
if (catal->type == XML_SGML_CATALOG_TYPE) {
106+
xmlChar *content;
107+
@@ -2780,7 +2792,7 @@ xmlExpandCatalog(xmlCatalogPtr catal, const char *filename)
108+
if (content == NULL)
109+
return(-1);
110+
111+
- ret = xmlParseSGMLCatalog(catal, content, filename, 0);
112+
+ ret = xmlParseSGMLCatalog(catal, content, filename, 0, depth + 1);
113+
if (ret < 0) {
114+
xmlFree(content);
115+
return(-1);
116+
@@ -3250,7 +3262,7 @@ xmlLoadCatalog(const char *filename)
117+
return(0);
118+
}
119+
120+
- ret = xmlExpandCatalog(xmlDefaultCatalog, filename);
121+
+ ret = xmlExpandCatalog(xmlDefaultCatalog, filename, 0);
122+
xmlRMutexUnlock(xmlCatalogMutex);
123+
return(ret);
124+
}
125+
diff --git a/result/catalogs/recursive b/result/catalogs/recursive
126+
new file mode 100644
127+
index 0000000..d9e80f6
128+
--- /dev/null
129+
+++ b/result/catalogs/recursive
130+
@@ -0,0 +1 @@
131+
+>
132+
diff --git a/test/catalogs/recursive.script b/test/catalogs/recursive.script
133+
new file mode 100644
134+
index 0000000..e69de29
135+
diff --git a/test/catalogs/recursive.sgml b/test/catalogs/recursive.sgml
136+
new file mode 100644
137+
index 0000000..ac2148b
138+
--- /dev/null
139+
+++ b/test/catalogs/recursive.sgml
140+
@@ -0,0 +1 @@
141+
+CATALOG recursive.sgml
142+
--
143+
2.45.4
144+

‎SPECS/libxml2/CVE-2026-0990.patch‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
2+
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
3+
Date: Wed, 17 Dec 2025 15:24:08 +0100
4+
Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
5+
6+
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
7+
8+
Upstream Patch reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982.patch
9+
---
10+
catalog.c | 31 +++++++++++++++++++++++--------
11+
1 file changed, 23 insertions(+), 8 deletions(-)
12+
13+
diff --git a/catalog.c b/catalog.c
14+
index 24a49f3..20e9576 100644
15+
--- a/catalog.c
16+
+++ b/catalog.c
17+
@@ -2087,12 +2087,21 @@ static xmlChar *
18+
xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
19+
xmlChar *ret = NULL;
20+
xmlChar *urnID = NULL;
21+
+ xmlCatalogEntryPtr cur = NULL;
22+
23+
if (catal == NULL)
24+
return(NULL);
25+
if (URI == NULL)
26+
return(NULL);
27+
28+
+ if (catal->depth > MAX_CATAL_DEPTH) {
29+
+ xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
30+
+ "Detected recursion in catalog %s\n",
31+
+ catal->name, NULL, NULL);
32+
+ return(NULL);
33+
+ }
34+
+ catal->depth++;
35+
+
36+
if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
37+
urnID = xmlCatalogUnWrapURN(URI);
38+
if (xmlDebugCatalogs) {
39+
@@ -2106,21 +2115,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
40+
ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
41+
if (urnID != NULL)
42+
xmlFree(urnID);
43+
+ catal->depth--;
44+
return(ret);
45+
}
46+
- while (catal != NULL) {
47+
- if (catal->type == XML_CATA_CATALOG) {
48+
- if (catal->children == NULL) {
49+
- xmlFetchXMLCatalogFile(catal);
50+
+ cur = catal;
51+
+ while (cur != NULL) {
52+
+ if (cur->type == XML_CATA_CATALOG) {
53+
+ if (cur->children == NULL) {
54+
+ xmlFetchXMLCatalogFile(cur);
55+
}
56+
- if (catal->children != NULL) {
57+
- ret = xmlCatalogXMLResolveURI(catal->children, URI);
58+
- if (ret != NULL)
59+
+ if (cur->children != NULL) {
60+
+ ret = xmlCatalogXMLResolveURI(cur->children, URI);
61+
+ if (ret != NULL) {
62+
+ catal->depth--;
63+
return(ret);
64+
+ }
65+
}
66+
}
67+
- catal = catal->next;
68+
+ cur = cur->next;
69+
}
70+
+
71+
+ catal->depth--;
72+
return(ret);
73+
}
74+
75+
--
76+
2.43.0
77+

‎SPECS/libxml2/CVE-2026-0992.patch‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
From f75abfcaa419a740a3191e56c60400f3ff18988d Mon Sep 17 00:00:00 2001
2+
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
3+
Date: Fri, 19 Dec 2025 11:02:18 +0100
4+
Subject: [PATCH] catalog: Ignore repeated nextCatalog entries
5+
6+
This patch makes the catalog parsing to ignore repeated entries of
7+
nextCatalog with the same value.
8+
9+
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
10+
11+
Upstream Patch reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/f75abfcaa419a740a3191e56c60400f3ff18988d.patch
12+
---
13+
catalog.c | 26 ++++++++++++++++++++++++++
14+
error.c | 11 +++++++++++
15+
2 files changed, 37 insertions(+)
16+
17+
diff --git a/catalog.c b/catalog.c
18+
index 20e9576..3886d84 100644
19+
--- a/catalog.c
20+
+++ b/catalog.c
21+
@@ -242,6 +242,14 @@ xmlCatalogErr(xmlCatalogEntryPtr catal, xmlNodePtr node, int error,
22+
msg, str1, str2, str3);
23+
}
24+
25+
+static void
26+
+xmlCatalogPrintDebug(const char *fmt, ...) {
27+
+ va_list ap;
28+
+
29+
+ va_start(ap, fmt);
30+
+ xmlVPrintErrorMessage(fmt, ap);
31+
+ va_end(ap);
32+
+}
33+
34+
/************************************************************************
35+
* *
36+
@@ -1267,9 +1275,27 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer,
37+
BAD_CAST "delegateURI", BAD_CAST "uriStartString",
38+
BAD_CAST "catalog", prefer, cgroup);
39+
} else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) {
40+
+ xmlCatalogEntryPtr prev = parent->children;
41+
+
42+
entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG,
43+
BAD_CAST "nextCatalog", NULL,
44+
BAD_CAST "catalog", prefer, cgroup);
45+
+ /* Avoid duplication of nextCatalog */
46+
+ while (prev != NULL) {
47+
+ if ((prev->type == XML_CATA_NEXT_CATALOG) &&
48+
+ (xmlStrEqual (prev->URL, entry->URL)) &&
49+
+ (xmlStrEqual (prev->value, entry->value)) &&
50+
+ (prev->prefer == entry->prefer) &&
51+
+ (prev->group == entry->group)) {
52+
+ if (xmlDebugCatalogs)
53+
+ xmlCatalogPrintDebug(
54+
+ "Ignoring repeated nextCatalog %s\n", entry->URL);
55+
+ xmlFreeCatalogEntry(entry, NULL);
56+
+ entry = NULL;
57+
+ break;
58+
+ }
59+
+ prev = prev->next;
60+
+ }
61+
}
62+
if (entry != NULL) {
63+
if (parent != NULL) {
64+
diff --git a/error.c b/error.c
65+
index 4de1418..a77e2da 100644
66+
--- a/error.c
67+
+++ b/error.c
68+
@@ -1022,3 +1022,14 @@ xmlCopyError(xmlErrorPtr from, xmlErrorPtr to) {
69+
return 0;
70+
}
71+
72+
+/**
73+
+ * Prints to stderr.
74+
+ *
75+
+ * @param fmt printf-like format string
76+
+ * @param ap arguments
77+
+ */
78+
+void
79+
+xmlVPrintErrorMessage(const char *fmt, va_list ap) {
80+
+ vfprintf(stderr, fmt, ap);
81+
+}
82+
+
83+
--
84+
2.43.0
85+

‎SPECS/libxml2/libxml2.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.11.5
4-
Release: 8%{?dist}
4+
Release: 9%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -22,6 +22,9 @@ Patch10: CVE-2025-6170.patch
2222
Patch11: CVE-2025-49794_CVE-2025-49796.patch
2323
Patch12: CVE-2025-49795.patch
2424
Patch13: CVE-2025-7425.patch
25+
Patch14: CVE-2026-0990.patch
26+
Patch15: CVE-2026-0992.patch
27+
Patch16: CVE-2025-8732.patch
2528

2629
BuildRequires: python3-devel
2730
BuildRequires: python3-xml
@@ -93,6 +96,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
9396
%{_libdir}/cmake/libxml2/libxml2-config.cmake
9497

9598
%changelog
99+
* Mon Jan 19 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.11.5-9
100+
- Patch for CVE-2026-0990, CVE-2026-0992, CVE-2025-8732
101+
96102
* Mon Jan 12 2026 Akhila Guruju <v-guakhila@microsoft.com> - 2.11.5-8
97103
- Patch CVE-2025-7525
98104

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-5.azl3.aarch64.rpm
203203
curl-devel-8.11.1-5.azl3.aarch64.rpm
204204
curl-libs-8.11.1-5.azl3.aarch64.rpm
205205
createrepo_c-1.0.3-1.azl3.aarch64.rpm
206-
libxml2-2.11.5-8.azl3.aarch64.rpm
207-
libxml2-devel-2.11.5-8.azl3.aarch64.rpm
206+
libxml2-2.11.5-9.azl3.aarch64.rpm
207+
libxml2-devel-2.11.5-9.azl3.aarch64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-5.azl3.x86_64.rpm
203203
curl-devel-8.11.1-5.azl3.x86_64.rpm
204204
curl-libs-8.11.1-5.azl3.x86_64.rpm
205205
createrepo_c-1.0.3-1.azl3.x86_64.rpm
206-
libxml2-2.11.5-8.azl3.x86_64.rpm
207-
libxml2-devel-2.11.5-8.azl3.x86_64.rpm
206+
libxml2-2.11.5-9.azl3.x86_64.rpm
207+
libxml2-devel-2.11.5-9.azl3.x86_64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,9 @@ libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
242242
libxcrypt-4.4.36-2.azl3.aarch64.rpm
243243
libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm
244244
libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
245-
libxml2-2.11.5-8.azl3.aarch64.rpm
246-
libxml2-debuginfo-2.11.5-8.azl3.aarch64.rpm
247-
libxml2-devel-2.11.5-8.azl3.aarch64.rpm
245+
libxml2-2.11.5-9.azl3.aarch64.rpm
246+
libxml2-debuginfo-2.11.5-9.azl3.aarch64.rpm
247+
libxml2-devel-2.11.5-9.azl3.aarch64.rpm
248248
libxslt-1.1.43-3.azl3.aarch64.rpm
249249
libxslt-debuginfo-1.1.43-3.azl3.aarch64.rpm
250250
libxslt-devel-1.1.43-3.azl3.aarch64.rpm
@@ -544,7 +544,7 @@ python3-jinja2-3.1.2-3.azl3.noarch.rpm
544544
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
545545
python3-libmount-2.40.2-3.azl3.aarch64.rpm
546546
python3-libs-3.12.9-9.azl3.aarch64.rpm
547-
python3-libxml2-2.11.5-8.azl3.aarch64.rpm
547+
python3-libxml2-2.11.5-9.azl3.aarch64.rpm
548548
python3-lxml-4.9.3-1.azl3.aarch64.rpm
549549
python3-magic-5.45-1.azl3.noarch.rpm
550550
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm

0 commit comments

Comments
 (0)