Skip to content

Commit 871dde8

Browse files
[AutoPR- Security] Patch libxml2 for CVE-2026-0992, CVE-2026-0990, CVE-2025-7425 [HIGH] (#15583)
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
1 parent 670d4a4 commit 871dde8

8 files changed

Lines changed: 983 additions & 13 deletions

File tree

SPECS/libxml2/CVE-2025-7425.patch

Lines changed: 801 additions & 0 deletions
Large diffs are not rendered by default.

SPECS/libxml2/CVE-2026-0990.patch

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
From 9f4c3269fbe63615c4f9df620f734399ae04e307 Mon Sep 17 00:00:00 2001
2+
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
3+
Date: Wed, 17 Dec 2025 15:24:08 +0100
4+
Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
5+
6+
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982.patch
10+
---
11+
catalog.c | 31 +++++++++++++++++++++++--------
12+
1 file changed, 23 insertions(+), 8 deletions(-)
13+
14+
diff --git a/catalog.c b/catalog.c
15+
index b7837e3..d66ee45 100644
16+
--- a/catalog.c
17+
+++ b/catalog.c
18+
@@ -2091,12 +2091,21 @@ static xmlChar *
19+
xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
20+
xmlChar *ret = NULL;
21+
xmlChar *urnID = NULL;
22+
+ xmlCatalogEntryPtr cur = NULL;
23+
24+
if (catal == NULL)
25+
return(NULL);
26+
if (URI == NULL)
27+
return(NULL);
28+
29+
+ if (catal->depth > MAX_CATAL_DEPTH) {
30+
+ xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
31+
+ "Detected recursion in catalog %s\n",
32+
+ catal->name, NULL, NULL);
33+
+ return(NULL);
34+
+ }
35+
+ catal->depth++;
36+
+
37+
if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
38+
urnID = xmlCatalogUnWrapURN(URI);
39+
if (xmlDebugCatalogs) {
40+
@@ -2110,21 +2119,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
41+
ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
42+
if (urnID != NULL)
43+
xmlFree(urnID);
44+
+ catal->depth--;
45+
return(ret);
46+
}
47+
- while (catal != NULL) {
48+
- if (catal->type == XML_CATA_CATALOG) {
49+
- if (catal->children == NULL) {
50+
- xmlFetchXMLCatalogFile(catal);
51+
+ cur = catal;
52+
+ while (cur != NULL) {
53+
+ if (cur->type == XML_CATA_CATALOG) {
54+
+ if (cur->children == NULL) {
55+
+ xmlFetchXMLCatalogFile(cur);
56+
}
57+
- if (catal->children != NULL) {
58+
- ret = xmlCatalogXMLResolveURI(catal->children, URI);
59+
- if (ret != NULL)
60+
+ if (cur->children != NULL) {
61+
+ ret = xmlCatalogXMLResolveURI(cur->children, URI);
62+
+ if (ret != NULL) {
63+
+ catal->depth--;
64+
return(ret);
65+
+ }
66+
}
67+
}
68+
- catal = catal->next;
69+
+ cur = cur->next;
70+
}
71+
+
72+
+ catal->depth--;
73+
return(ret);
74+
}
75+
76+
--
77+
2.45.4
78+

SPECS/libxml2/CVE-2026-0992.patch

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
rom f75abfcaa419a740a3191e56c60400f3ff18988d Mon Sep 17 00:00:00 2001
2+
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
3+
Date: Fri, 19 Dec 2025 11:02:18 +0100
4+
Subject: [PATCH] catalog: Ignore repeated nextCatalog entries
5+
6+
This patch makes the catalog parsing to ignore repeated entries of
7+
nextCatalog with the same value.
8+
9+
Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
10+
11+
Upstream Patch reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/f75abfcaa419a740a3191e56c60400f3ff18988d.patch
12+
---
13+
catalog.c | 26 ++++++++++++++++++++++++++
14+
error.c | 11 +++++++++++
15+
2 files changed, 37 insertions(+)
16+
17+
diff --git a/catalog.c b/catalog.c
18+
index 20e9576..3886d84 100644
19+
--- a/catalog.c
20+
+++ b/catalog.c
21+
@@ -242,6 +242,14 @@ xmlCatalogErr(xmlCatalogEntryPtr catal, xmlNodePtr node, int error,
22+
msg, str1, str2, str3);
23+
}
24+
25+
+static void
26+
+xmlCatalogPrintDebug(const char *fmt, ...) {
27+
+ va_list ap;
28+
+
29+
+ va_start(ap, fmt);
30+
+ xmlVPrintErrorMessage(fmt, ap);
31+
+ va_end(ap);
32+
+}
33+
34+
/************************************************************************
35+
* *
36+
@@ -1267,9 +1275,27 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer,
37+
BAD_CAST "delegateURI", BAD_CAST "uriStartString",
38+
BAD_CAST "catalog", prefer, cgroup);
39+
} else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) {
40+
+ xmlCatalogEntryPtr prev = parent->children;
41+
+
42+
entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG,
43+
BAD_CAST "nextCatalog", NULL,
44+
BAD_CAST "catalog", prefer, cgroup);
45+
+ /* Avoid duplication of nextCatalog */
46+
+ while (prev != NULL) {
47+
+ if ((prev->type == XML_CATA_NEXT_CATALOG) &&
48+
+ (xmlStrEqual (prev->URL, entry->URL)) &&
49+
+ (xmlStrEqual (prev->value, entry->value)) &&
50+
+ (prev->prefer == entry->prefer) &&
51+
+ (prev->group == entry->group)) {
52+
+ if (xmlDebugCatalogs)
53+
+ xmlCatalogPrintDebug(
54+
+ "Ignoring repeated nextCatalog %s\n", entry->URL);
55+
+ xmlFreeCatalogEntry(entry, NULL);
56+
+ entry = NULL;
57+
+ break;
58+
+ }
59+
+ prev = prev->next;
60+
+ }
61+
}
62+
if (entry != NULL) {
63+
if (parent != NULL) {
64+
diff --git a/error.c b/error.c
65+
index 4de1418..a77e2da 100644
66+
--- a/error.c
67+
+++ b/error.c
68+
@@ -1022,3 +1022,14 @@ xmlCopyError(xmlErrorPtr from, xmlErrorPtr to) {
69+
return 0;
70+
}
71+
72+
+/**
73+
+ * Prints to stderr.
74+
+ *
75+
+ * @param fmt printf-like format string
76+
+ * @param ap arguments
77+
+ */
78+
+void
79+
+xmlVPrintErrorMessage(const char *fmt, va_list ap) {
80+
+ vfprintf(stderr, fmt, ap);
81+
+}
82+
+
83+
--
84+
2.43.0
85+

SPECS/libxml2/libxml2.spec

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.10.4
4-
Release: 9%{?dist}
4+
Release: 10%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -21,6 +21,9 @@ Patch9: CVE-2025-6170.patch
2121
Patch10: CVE-2025-6021.patch
2222
Patch11: CVE-2025-49794_CVE-2025-49796.patch
2323
Patch12: CVE-2025-49795.patch
24+
Patch13: CVE-2025-7425.patch
25+
Patch14: CVE-2026-0990.patch
26+
Patch15: CVE-2026-0992.patch
2427
BuildRequires: python3-devel
2528
BuildRequires: python3-xml
2629
Provides: %{name}-tools = %{version}-%{release}
@@ -91,6 +94,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
9194
%{_libdir}/cmake/libxml2/libxml2-config.cmake
9295

9396
%changelog
97+
* Tue Jan 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.10.4-10
98+
- Patch for CVE-2026-0992, CVE-2026-0990, CVE-2025-7425
99+
94100
* Wed Oct 29 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.10.4-9
95101
- Patch for CVE-2025-49795
96102

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-7.cm2.aarch64.rpm
194194
curl-devel-8.8.0-7.cm2.aarch64.rpm
195195
curl-libs-8.8.0-7.cm2.aarch64.rpm
196196
createrepo_c-0.17.5-1.cm2.aarch64.rpm
197-
libxml2-2.10.4-9.cm2.aarch64.rpm
198-
libxml2-devel-2.10.4-9.cm2.aarch64.rpm
197+
libxml2-2.10.4-10.cm2.aarch64.rpm
198+
libxml2-devel-2.10.4-10.cm2.aarch64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-7.cm2.x86_64.rpm
194194
curl-devel-8.8.0-7.cm2.x86_64.rpm
195195
curl-libs-8.8.0-7.cm2.x86_64.rpm
196196
createrepo_c-0.17.5-1.cm2.x86_64.rpm
197-
libxml2-2.10.4-9.cm2.x86_64.rpm
198-
libxml2-devel-2.10.4-9.cm2.x86_64.rpm
197+
libxml2-2.10.4-10.cm2.x86_64.rpm
198+
libxml2-devel-2.10.4-10.cm2.x86_64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.aarch64.rpm
209209
libtasn1-devel-4.19.0-2.cm2.aarch64.rpm
210210
libtool-2.4.6-8.cm2.aarch64.rpm
211211
libtool-debuginfo-2.4.6-8.cm2.aarch64.rpm
212-
libxml2-2.10.4-9.cm2.aarch64.rpm
213-
libxml2-debuginfo-2.10.4-9.cm2.aarch64.rpm
214-
libxml2-devel-2.10.4-9.cm2.aarch64.rpm
212+
libxml2-2.10.4-10.cm2.aarch64.rpm
213+
libxml2-debuginfo-2.10.4-10.cm2.aarch64.rpm
214+
libxml2-devel-2.10.4-10.cm2.aarch64.rpm
215215
libxslt-1.1.34-10.cm2.aarch64.rpm
216216
libxslt-debuginfo-1.1.34-10.cm2.aarch64.rpm
217217
libxslt-devel-1.1.34-10.cm2.aarch64.rpm
@@ -521,7 +521,7 @@ python3-gpg-1.16.0-2.cm2.aarch64.rpm
521521
python3-jinja2-3.0.3-7.cm2.noarch.rpm
522522
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
523523
python3-libs-3.9.19-17.cm2.aarch64.rpm
524-
python3-libxml2-2.10.4-9.cm2.aarch64.rpm
524+
python3-libxml2-2.10.4-10.cm2.aarch64.rpm
525525
python3-lxml-4.9.1-1.cm2.aarch64.rpm
526526
python3-magic-5.40-3.cm2.noarch.rpm
527527
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -215,9 +215,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.x86_64.rpm
215215
libtasn1-devel-4.19.0-2.cm2.x86_64.rpm
216216
libtool-2.4.6-8.cm2.x86_64.rpm
217217
libtool-debuginfo-2.4.6-8.cm2.x86_64.rpm
218-
libxml2-2.10.4-9.cm2.x86_64.rpm
219-
libxml2-debuginfo-2.10.4-9.cm2.x86_64.rpm
220-
libxml2-devel-2.10.4-9.cm2.x86_64.rpm
218+
libxml2-2.10.4-10.cm2.x86_64.rpm
219+
libxml2-debuginfo-2.10.4-10.cm2.x86_64.rpm
220+
libxml2-devel-2.10.4-10.cm2.x86_64.rpm
221221
libxslt-1.1.34-10.cm2.x86_64.rpm
222222
libxslt-debuginfo-1.1.34-10.cm2.x86_64.rpm
223223
libxslt-devel-1.1.34-10.cm2.x86_64.rpm
@@ -527,7 +527,7 @@ python3-gpg-1.16.0-2.cm2.x86_64.rpm
527527
python3-jinja2-3.0.3-7.cm2.noarch.rpm
528528
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
529529
python3-libs-3.9.19-17.cm2.x86_64.rpm
530-
python3-libxml2-2.10.4-9.cm2.x86_64.rpm
530+
python3-libxml2-2.10.4-10.cm2.x86_64.rpm
531531
python3-lxml-4.9.1-1.cm2.x86_64.rpm
532532
python3-magic-5.40-3.cm2.noarch.rpm
533533
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)