Skip to content

Commit 5ca96e3

Browse files
archana25-msarchana25-ms
authored
[MEDIUM] Patch libxslt for CVE-2025-7424 (#15254)
1 parent 30334fe commit 5ca96e3

7 files changed

Lines changed: 369 additions & 9 deletions

File tree

‎SPECS/libxslt/CVE-2025-7424.patch‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
From f6f7f59998c0642b395ba07e5a30e68866df277d Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Iv=C3=A1n=20Chavero?= <ichavero@chavero.com.mx>
3+
Date: Mon, 24 Nov 2025 01:05:00 -0600
4+
Subject: [PATCH] Fix Type confusion in xmlNode.psvi between stylesheet and
5+
source nodes
6+
7+
* libxslt/functions.c:
8+
(xsltDocumentFunctionLoadDocument):
9+
- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
10+
calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
11+
xmlDoc to tctxt->docList.
12+
- Add error handling for functions that may return NULL.
13+
* libxslt/transform.c:
14+
- Remove static keyword so this can be called from
15+
xsltDocumentFunctionLoadDocument().
16+
* libxslt/transformInternals.h: Add.
17+
(xsltCleanupSourceDoc): Add declaration.
18+
19+
Original author: David Kilzer <ddkilzer@apple.com>
20+
21+
Fixes: #139 CVE-2025-7424
22+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxslt/-/commit/f6f7f59998c0642b395ba07e5a30e68866df277d.patch
23+
---
24+
libxslt/functions.c | 16 +++++++++++++++-
25+
libxslt/transform.c | 3 ++-
26+
libxslt/transformInternals.h | 9 +++++++++
27+
3 files changed, 26 insertions(+), 2 deletions(-)
28+
create mode 100644 libxslt/transformInternals.h
29+
30+
diff --git a/libxslt/functions.c b/libxslt/functions.c
31+
index dd8bf7a..e821e3c 100644
32+
--- a/libxslt/functions.c
33+
+++ b/libxslt/functions.c
34+
@@ -41,6 +41,7 @@
35+
#include "numbersInternals.h"
36+
#include "keys.h"
37+
#include "documents.h"
38+
+#include "transformInternals.h"
39+
40+
#ifdef WITH_XSLT_DEBUG
41+
#define WITH_XSLT_DEBUG_FUNCTION
42+
@@ -152,7 +153,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, xmlChar* URI)
43+
/*
44+
* This selects the stylesheet's doc itself.
45+
*/
46+
- doc = tctxt->style->doc;
47+
+ doc = xmlCopyDoc(tctxt->style->doc, 1);
48+
+ if (doc == NULL) {
49+
+ xsltTransformError(tctxt, NULL, NULL,
50+
+ "document() : failed to copy style doc\n");
51+
+ goto out_fragment;
52+
+ }
53+
+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
54+
+ idoc = xsltNewDocument(tctxt, doc);
55+
+ if (idoc == NULL) {
56+
+ xsltTransformError(tctxt, NULL, NULL,
57+
+ "document() : failed to create xsltDocument\n");
58+
+ xmlFreeDoc(doc);
59+
+ goto out_fragment;
60+
+ }
61+
} else {
62+
valuePush(ctxt, xmlXPathNewNodeSet(NULL));
63+
64+
diff --git a/libxslt/transform.c b/libxslt/transform.c
65+
index e79a9ac..e11f8df 100644
66+
--- a/libxslt/transform.c
67+
+++ b/libxslt/transform.c
68+
@@ -42,6 +42,7 @@
69+
#include "xsltutils.h"
70+
#include "pattern.h"
71+
#include "transform.h"
72+
+#include "transformInternals.h"
73+
#include "variables.h"
74+
#include "numbersInternals.h"
75+
#include "namespaces.h"
76+
@@ -5750,7 +5751,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
77+
*
78+
* Resets source node flags and ids stored in 'psvi' member.
79+
*/
80+
-static void
81+
+void
82+
xsltCleanupSourceDoc(xmlDocPtr doc) {
83+
xmlNodePtr cur = (xmlNodePtr) doc;
84+
void **psviPtr;
85+
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
86+
new file mode 100644
87+
index 0000000..d0f4282
88+
--- /dev/null
89+
+++ b/libxslt/transformInternals.h
90+
@@ -0,0 +1,9 @@
91+
+/*
92+
+ * Summary: set of internal interfaces for the XSLT engine transformation part.
93+
+ *
94+
+ * Copy: See Copyright for the status of this software.
95+
+ *
96+
+ * Author: David Kilzer <ddkilzer@apple.com>
97+
+ */
98+
+
99+
+void xsltCleanupSourceDoc(xmlDocPtr doc);

‎SPECS/libxslt/libxslt-source-node-extra-data-infra.patch‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
From adebe45f6ef9f9d036acacd8aec7411d4ea84e25 Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <wellnhofer@aevum.de>
3+
Date: Wed, 31 Aug 2022 15:29:57 +0200
4+
Subject: [PATCH] Infrastructure to store extra data in source nodes
5+
6+
Provide a mechanism to store bit flags in nodes from the source
7+
document. This will later be used to store key and id status.
8+
9+
Provide a function to find the psvi member of a node.
10+
11+
Revert any changes to the source document after the transformation.
12+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxslt/-/commit/adebe45f6ef9f9d036acacd8aec7411d4ea84e25
13+
---
14+
libxslt/transform.c | 34 ++++++++++
15+
libxslt/xsltInternals.h | 1 +
16+
libxslt/xsltutils.c | 135 ++++++++++++++++++++++++++++++++++++++++
17+
libxslt/xsltutils.h | 13 ++++
18+
4 files changed, 183 insertions(+)
19+
20+
diff --git a/libxslt/transform.c b/libxslt/transform.c
21+
index cb43bb47..512eb024 100644
22+
--- a/libxslt/transform.c
23+
+++ b/libxslt/transform.c
24+
@@ -5746,6 +5746,37 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
25+
return(ctxt->nbKeys);
26+
}
27+
28+
+/**
29+
+ * xsltCleanupSourceDoc:
30+
+ * @doc: Document
31+
+ *
32+
+ * Resets source node flags and ids stored in 'psvi' member.
33+
+ */
34+
+static void
35+
+xsltCleanupSourceDoc(xmlDocPtr doc) {
36+
+ xmlNodePtr cur = (xmlNodePtr) doc;
37+
+ void **psviPtr;
38+
+
39+
+ while (1) {
40+
+ xsltClearSourceNodeFlags(cur, XSLT_SOURCE_NODE_MASK);
41+
+ psviPtr = xsltGetPSVIPtr(cur);
42+
+ if (psviPtr)
43+
+ *psviPtr = NULL;
44+
+
45+
+ if (cur->children != NULL && cur->type != XML_ENTITY_REF_NODE) {
46+
+ cur = cur->children;
47+
+ } else {
48+
+ while (cur->next == NULL) {
49+
+ cur = cur->parent;
50+
+ if (cur == (xmlNodePtr) doc)
51+
+ return;
52+
+ }
53+
+
54+
+ cur = cur->next;
55+
+ }
56+
+ }
57+
+}
58+
+
59+
/**
60+
* xsltApplyStylesheetInternal:
61+
* @style: a parsed XSLT stylesheet
62+
@@ -6144,6 +6175,9 @@ xsltApplyStylesheetInternal(xsltStylesheetPtr style, xmlDocPtr doc,
63+
printf("# Reused variables : %d\n", ctxt->cache->dbgReusedVars);
64+
#endif
65+
66+
+ if (ctxt->sourceDocDirty)
67+
+ xsltCleanupSourceDoc(doc);
68+
+
69+
if ((ctxt != NULL) && (userCtxt == NULL))
70+
xsltFreeTransformContext(ctxt);
71+
72+
diff --git a/libxslt/xsltInternals.h b/libxslt/xsltInternals.h
73+
index 14343d27..b0125c21 100644
74+
--- a/libxslt/xsltInternals.h
75+
+++ b/libxslt/xsltInternals.h
76+
@@ -1786,6 +1786,7 @@ struct _xsltTransformContext {
77+
int maxTemplateVars;
78+
unsigned long opLimit;
79+
unsigned long opCount;
80+
+ int sourceDocDirty;
81+
};
82+
83+
/**
84+
diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c
85+
index f352ca1b..9f0feb53 100644
86+
--- a/libxslt/xsltutils.c
87+
+++ b/libxslt/xsltutils.c
88+
@@ -1834,6 +1834,141 @@ xsltSaveResultToString(xmlChar **doc_txt_ptr, int * doc_txt_len,
89+
return 0;
90+
}
91+
92+
+/**
93+
+ * xsltGetSourceNodeFlags:
94+
+ * @node: Node from source document
95+
+ *
96+
+ * Returns the flags for a source node.
97+
+ */
98+
+int
99+
+xsltGetSourceNodeFlags(xmlNodePtr node) {
100+
+ /*
101+
+ * Squeeze the bit flags into the upper bits of
102+
+ *
103+
+ * - 'int properties' member in struct _xmlDoc
104+
+ * - 'xmlAttributeType atype' member in struct _xmlAttr
105+
+ * - 'unsigned short extra' member in struct _xmlNode
106+
+ */
107+
+ switch (node->type) {
108+
+ case XML_DOCUMENT_NODE:
109+
+ case XML_HTML_DOCUMENT_NODE:
110+
+ return ((xmlDocPtr) node)->properties >> 27;
111+
+
112+
+ case XML_ATTRIBUTE_NODE:
113+
+ return ((xmlAttrPtr) node)->atype >> 27;
114+
+
115+
+ case XML_ELEMENT_NODE:
116+
+ case XML_TEXT_NODE:
117+
+ case XML_CDATA_SECTION_NODE:
118+
+ case XML_PI_NODE:
119+
+ case XML_COMMENT_NODE:
120+
+ return node->extra >> 12;
121+
+
122+
+ default:
123+
+ return 0;
124+
+ }
125+
+}
126+
+
127+
+/**
128+
+ * xsltSetSourceNodeFlags:
129+
+ * @node: Node from source document
130+
+ * @flags: Flags
131+
+ *
132+
+ * Sets the specified flags to 1.
133+
+ *
134+
+ * Returns 0 on success, -1 on error.
135+
+ */
136+
+int
137+
+xsltSetSourceNodeFlags(xsltTransformContextPtr ctxt, xmlNodePtr node,
138+
+ int flags) {
139+
+ if (node->doc == ctxt->initialContextDoc)
140+
+ ctxt->sourceDocDirty = 1;
141+
+
142+
+ switch (node->type) {
143+
+ case XML_DOCUMENT_NODE:
144+
+ case XML_HTML_DOCUMENT_NODE:
145+
+ ((xmlDocPtr) node)->properties |= flags << 27;
146+
+ return 0;
147+
+
148+
+ case XML_ATTRIBUTE_NODE:
149+
+ ((xmlAttrPtr) node)->atype |= flags << 27;
150+
+ return 0;
151+
+
152+
+ case XML_ELEMENT_NODE:
153+
+ case XML_TEXT_NODE:
154+
+ case XML_CDATA_SECTION_NODE:
155+
+ case XML_PI_NODE:
156+
+ case XML_COMMENT_NODE:
157+
+ node->extra |= flags << 12;
158+
+ return 0;
159+
+
160+
+ default:
161+
+ return -1;
162+
+ }
163+
+}
164+
+
165+
+/**
166+
+ * xsltClearSourceNodeFlags:
167+
+ * @node: Node from source document
168+
+ * @flags: Flags
169+
+ *
170+
+ * Sets the specified flags to 0.
171+
+ *
172+
+ * Returns 0 on success, -1 on error.
173+
+ */
174+
+int
175+
+xsltClearSourceNodeFlags(xmlNodePtr node, int flags) {
176+
+ switch (node->type) {
177+
+ case XML_DOCUMENT_NODE:
178+
+ case XML_HTML_DOCUMENT_NODE:
179+
+ ((xmlDocPtr) node)->properties &= ~(flags << 27);
180+
+ return 0;
181+
+
182+
+ case XML_ATTRIBUTE_NODE:
183+
+ ((xmlAttrPtr) node)->atype &= ~(flags << 27);
184+
+ return 0;
185+
+
186+
+ case XML_ELEMENT_NODE:
187+
+ case XML_TEXT_NODE:
188+
+ case XML_CDATA_SECTION_NODE:
189+
+ case XML_PI_NODE:
190+
+ case XML_COMMENT_NODE:
191+
+ node->extra &= ~(flags << 12);
192+
+ return 0;
193+
+
194+
+ default:
195+
+ return -1;
196+
+ }
197+
+}
198+
+
199+
+/**
200+
+ * xsltGetPSVIPtr:
201+
+ * @cur: Node
202+
+ *
203+
+ * Returns a pointer to the psvi member of a node or NULL on error.
204+
+ */
205+
+void **
206+
+xsltGetPSVIPtr(xmlNodePtr cur) {
207+
+ switch (cur->type) {
208+
+ case XML_DOCUMENT_NODE:
209+
+ case XML_HTML_DOCUMENT_NODE:
210+
+ return &((xmlDocPtr) cur)->psvi;
211+
+
212+
+ case XML_ATTRIBUTE_NODE:
213+
+ return &((xmlAttrPtr) cur)->psvi;
214+
+
215+
+ case XML_ELEMENT_NODE:
216+
+ case XML_TEXT_NODE:
217+
+ case XML_CDATA_SECTION_NODE:
218+
+ case XML_PI_NODE:
219+
+ case XML_COMMENT_NODE:
220+
+ return &cur->psvi;
221+
+
222+
+ default:
223+
+ return NULL;
224+
+ }
225+
+}
226+
+
227+
#ifdef WITH_PROFILER
228+
229+
/************************************************************************
230+
diff --git a/libxslt/xsltutils.h b/libxslt/xsltutils.h
231+
index 7a12f7b3..65ef78e0 100644
232+
--- a/libxslt/xsltutils.h
233+
+++ b/libxslt/xsltutils.h
234+
@@ -244,6 +244,19 @@ XSLTPUBFUN xmlXPathCompExprPtr XSLTCALL
235+
const xmlChar *str,
236+
int flags);
237+
238+
+#ifdef IN_LIBXSLT
239+
+#define XSLT_SOURCE_NODE_MASK 15
240+
+int
241+
+xsltGetSourceNodeFlags(xmlNodePtr node);
242+
+int
243+
+xsltSetSourceNodeFlags(xsltTransformContextPtr ctxt, xmlNodePtr node,
244+
+ int flags);
245+
+int
246+
+xsltClearSourceNodeFlags(xmlNodePtr node, int flags);
247+
+void **
248+
+xsltGetPSVIPtr(xmlNodePtr cur);
249+
+#endif
250+
+
251+
/*
252+
* Profiling.
253+
*/
254+
--
255+
GitLab
256+

‎SPECS/libxslt/libxslt.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxslt is the XSLT C library developed for the GNOME project. XSLT is a an XML language to define transformation for XML.
22
Name: libxslt
33
Version: 1.1.34
4-
Release: 9%{?dist}
4+
Release: 10%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -14,6 +14,8 @@ Patch1: CVE-2022-29824.nopatch
1414
Patch2: CVE-2024-55549.patch
1515
Patch3: CVE-2025-24855.patch
1616
Patch4: CVE-2025-11731.patch
17+
Patch5: libxslt-source-node-extra-data-infra.patch
18+
Patch6: CVE-2025-7424.patch
1719
BuildRequires: libgcrypt-devel
1820
BuildRequires: libxml2-devel
1921
Requires: libgcrypt
@@ -77,6 +79,9 @@ make %{?_smp_mflags} check
7779
%{_mandir}/man3/*
7880

7981
%changelog
82+
* Thu Dec 18 2025 Archana Shettigar <v-shettigara@microsoft.com> - 1.1.34-10
83+
- Patch for CVE-2025-7424
84+
8085
* Fri Nov 21 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.1.34-9
8186
- Patch for CVE-2025-11731
8287

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ libgpg-error-1.46-1.cm2.aarch64.rpm
218218
libgcrypt-1.10.3-1.cm2.aarch64.rpm
219219
libksba-1.6.3-1.cm2.aarch64.rpm
220220
libksba-devel-1.6.3-1.cm2.aarch64.rpm
221-
libxslt-1.1.34-9.cm2.aarch64.rpm
221+
libxslt-1.1.34-10.cm2.aarch64.rpm
222222
npth-1.6-4.cm2.aarch64.rpm
223223
pinentry-1.2.0-1.cm2.aarch64.rpm
224224
gnupg2-2.4.0-2.cm2.aarch64.rpm

0 commit comments

Comments
 (0)