rpms/libxml2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-11979: overflow checks in xmlcatalog shell

Browse Source 
Backport upstream commit c2e233fc1b34 to fix CVE-2026-11979,
which adds overflow bounds checks in the usershell() function
of xmlcatalog.c. The patch prevents buffer overflows when
processing large --shell commands by adding capacity checks
for the command buffer, argument buffer, and argv array size.

The upstream test changes were dropped as the test
infrastructure (test/catalogs/test.sh) does not exist in the
v2.9.7 source tree.

CVE: CVE-2026-11979
Upstream patches:
 - c2e233fc1b.patch
Resolves: RHEL-215569

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-27 08:15:48 +00:00
parent c7565c5522
commit 237839f960
2 changed files with 58 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
libxml2-2.15.0-CVE-2026-11979.patch Normal file
View File

@ -0,0 +1,51 @@
From a28c059f727f0bac8d702d03015ee5c959bea159 Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
Date: Fri, 22 May 2026 12:21:20 +0200
Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
---
xmlcatalog.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/xmlcatalog.c b/xmlcatalog.c
index c02b97f6..a1c9064e 100644
--- a/xmlcatalog.c
+++ b/xmlcatalog.c
@@ -118,6 +118,12 @@ static void usershell(void) {
(*cur != '\n') && (*cur != '\r')) {
if (*cur == 0)
break;
+ /* Do not read beyond the command array capacity */
+ if (i >= (int)sizeof(command) - 2) {
+ printf("Invalid command %s\n", cur);
+ i = 0;
+ break;
+ }
command[i++] = *cur++;
}
command[i] = 0;
@@ -135,6 +141,11 @@ static void usershell(void) {
while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
if (*cur == 0)
break;
+ if (i >= (int)sizeof(arg) - 2) {
+ printf("Invalid arg %s\n", arg);
+ i = 0;
+ break;
+ }
arg[i++] = *cur++;
}
arg[i] = 0;
@@ -147,6 +158,11 @@ static void usershell(void) {
cur = arg;
memset(argv, 0, sizeof(argv));
while (*cur != 0) {
+ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
+ printf("Too much arguments\n");
+ break;
+ }
+
while ((*cur == ' ') || (*cur == '\t')) cur++;
if (*cur == '\'') {
cur++;

8
libxml2.spec
View File

@ -7,7 +7,7 @@
Name: libxml2
Version: 2.9.7
Release: 21%{?dist}.6
Release: 21%{?dist}.7
Summary: Library providing XML and HTML support
License: MIT
@ -90,6 +90,9 @@ Patch36: libxml2-2.9.13-CVE-2024-34459.patch
# https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/321
# https://redhat.atlassian.net/browse/RHEL-182012
Patch37: libxml2-2.12.5-CVE-2025-6170.patch
# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
# https://issues.redhat.com/browse/RHEL-215569
Patch38: libxml2-2.15.0-CVE-2026-11979.patch
BuildRequires: gcc
BuildRequires: cmake-rpm-macros
@ -261,6 +264,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
%{python3_sitearch}/libxml2mod.so
%changelog
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.9.7-21.7
- Fix CVE-2026-11979 (RHEL-215569)
* Tue Jun 16 2026 David King <dking@redhat.com> - 2.9.7-21.6
- Fix CVE-2025-6170 (RHEL-182012)