From 6f6132dc3aeb0d660c9730f6f33e9194a6098226 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sat, 9 Jul 2016 14:59:57 -0700 Subject: libxml2: Security fix for CVE-2016-4449 Affects limbxml2 < 2.9.4 Signed-off-by: Armin Kuster --- .../libxml/libxml2/CVE-2016-4449.patch | 47 ++++++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.9.2.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch (limited to 'meta') diff --git a/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch new file mode 100644 index 0000000000..f76bb10e9f --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2016-4449.patch @@ -0,0 +1,47 @@ +From b1d34de46a11323fccffa9fadeb33be670d602f5 Mon Sep 17 00:00:00 2001 +From: Daniel Veillard +Date: Mon, 14 Mar 2016 17:19:44 +0800 +Subject: [PATCH] Fix inappropriate fetch of entities content + +For https://bugzilla.gnome.org/show_bug.cgi?id=761430 + +libfuzzer regression testing exposed another case where the parser would +fetch content of an external entity while not in validating mode. +Plug that hole + +Upstream-status: Backport +CVE: CVE-2016-4449 + +Signed-off-by: Armin Kuster + +--- + parser.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +Index: libxml2-2.9.2/parser.c +=================================================================== +--- libxml2-2.9.2.orig/parser.c ++++ libxml2-2.9.2/parser.c +@@ -2873,7 +2873,21 @@ xmlStringLenDecodeEntities(xmlParserCtxt + ctxt->nbentities += ent->checked / 2; + if (ent != NULL) { + if (ent->content == NULL) { +- xmlLoadEntityContent(ctxt, ent); ++ /* ++ * Note: external parsed entities will not be loaded, ++ * it is not required for a non-validating parser to ++ * complete external PEreferences coming from the ++ * internal subset ++ */ ++ if (((ctxt->options & XML_PARSE_NOENT) != 0) || ++ ((ctxt->options & XML_PARSE_DTDVALID) != 0) || ++ (ctxt->validate != 0)) { ++ xmlLoadEntityContent(ctxt, ent); ++ } else { ++ xmlWarningMsg(ctxt, XML_ERR_ENTITY_PROCESSING, ++ "not validating will not read content for PE entity %s\n", ++ ent->name, NULL); ++ } + } + ctxt->depth++; + rep = xmlStringDecodeEntities(ctxt, ent->content, what, diff --git a/meta/recipes-core/libxml/libxml2_2.9.2.bb b/meta/recipes-core/libxml/libxml2_2.9.2.bb index 798337cb8b..10e4b563f3 100644 --- a/meta/recipes-core/libxml/libxml2_2.9.2.bb +++ b/meta/recipes-core/libxml/libxml2_2.9.2.bb @@ -12,6 +12,7 @@ SRC_URI += "file://CVE-2016-1762.patch \ file://CVE-2016-1838.patch \ file://CVE-2016-1839.patch \ file://CVE-2016-1836.patch \ + file://CVE-2016-4449.patch \ " SRC_URI[libtar.md5sum] = "9e6a9aca9d155737868b3dc5fd82f788" -- cgit 1.2.3-korg