From 237839f960b5285fecee585655617cf189023fd0 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 27 Jul 2026 08:15:48 +0000 Subject: [PATCH] Fix CVE-2026-11979: overflow checks in xmlcatalog shell Backport upstream commit c2e233fc1b34 to fix CVE-2026-11979, which adds overflow bounds checks in the usershell() function of xmlcatalog.c. The patch prevents buffer overflows when processing large --shell commands by adding capacity checks for the command buffer, argument buffer, and argv array size. The upstream test changes were dropped as the test infrastructure (test/catalogs/test.sh) does not exist in the v2.9.7 source tree. CVE: CVE-2026-11979 Upstream patches: - https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e.patch Resolves: RHEL-215569 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- libxml2-2.15.0-CVE-2026-11979.patch | 51 +++++++++++++++++++++++++++++ libxml2.spec | 8 ++++- 2 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 libxml2-2.15.0-CVE-2026-11979.patch diff --git a/libxml2-2.15.0-CVE-2026-11979.patch b/libxml2-2.15.0-CVE-2026-11979.patch new file mode 100644 index 0000000..ecf762b --- /dev/null +++ b/libxml2-2.15.0-CVE-2026-11979.patch @@ -0,0 +1,51 @@ +From a28c059f727f0bac8d702d03015ee5c959bea159 Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Fri, 22 May 2026 12:21:20 +0200 +Subject: [PATCH] xmlcatalog: overflow check for large --shell commands + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124 +--- + xmlcatalog.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/xmlcatalog.c b/xmlcatalog.c +index c02b97f6..a1c9064e 100644 +--- a/xmlcatalog.c ++++ b/xmlcatalog.c +@@ -118,6 +118,12 @@ static void usershell(void) { + (*cur != '\n') && (*cur != '\r')) { + if (*cur == 0) + break; ++ /* Do not read beyond the command array capacity */ ++ if (i >= (int)sizeof(command) - 2) { ++ printf("Invalid command %s\n", cur); ++ i = 0; ++ break; ++ } + command[i++] = *cur++; + } + command[i] = 0; +@@ -135,6 +141,11 @@ static void usershell(void) { + while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) { + if (*cur == 0) + break; ++ if (i >= (int)sizeof(arg) - 2) { ++ printf("Invalid arg %s\n", arg); ++ i = 0; ++ break; ++ } + arg[i++] = *cur++; + } + arg[i] = 0; +@@ -147,6 +158,11 @@ static void usershell(void) { + cur = arg; + memset(argv, 0, sizeof(argv)); + while (*cur != 0) { ++ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) { ++ printf("Too much arguments\n"); ++ break; ++ } ++ + while ((*cur == ' ') || (*cur == '\t')) cur++; + if (*cur == '\'') { + cur++; diff --git a/libxml2.spec b/libxml2.spec index f396556..b8ce1af 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -7,7 +7,7 @@ Name: libxml2 Version: 2.9.7 -Release: 21%{?dist}.6 +Release: 21%{?dist}.7 Summary: Library providing XML and HTML support License: MIT @@ -90,6 +90,9 @@ Patch36: libxml2-2.9.13-CVE-2024-34459.patch # https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/321 # https://redhat.atlassian.net/browse/RHEL-182012 Patch37: libxml2-2.12.5-CVE-2025-6170.patch +# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e +# https://issues.redhat.com/browse/RHEL-215569 +Patch38: libxml2-2.15.0-CVE-2026-11979.patch BuildRequires: gcc BuildRequires: cmake-rpm-macros @@ -261,6 +264,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %{python3_sitearch}/libxml2mod.so %changelog +* Mon Jul 27 2026 RHEL Packaging Agent - 2.9.7-21.7 +- Fix CVE-2026-11979 (RHEL-215569) + * Tue Jun 16 2026 David King - 2.9.7-21.6 - Fix CVE-2025-6170 (RHEL-182012)