diff --git a/libxml2-2.9.13-CVE-2024-56171.patch b/libxml2-2.9.13-CVE-2024-56171.patch new file mode 100644 index 0000000..96a2ab1 --- /dev/null +++ b/libxml2-2.9.13-CVE-2024-56171.patch @@ -0,0 +1,41 @@ +From 245b70d7d2768572ae1b05b3668ca858b9ec4ed4 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Tue, 10 Dec 2024 16:52:05 +0100 +Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after + xmlSchemaItemListAdd + +xmlSchemaItemListAdd can reallocate the items array. Update local +variables after adding item in + +- xmlSchemaIDCFillNodeTables +- xmlSchemaBubbleIDCNodeTables + +Fixes #828. +--- + xmlschemas.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/xmlschemas.c b/xmlschemas.c +index d276faf10..28b14bd44 100644 +--- a/xmlschemas.c ++++ b/xmlschemas.c +@@ -23388,6 +23388,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt, + } + if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1) + goto internal_error; ++ dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items; + /* + * Remove the duplicate entry from the IDC node-table. + */ +@@ -23604,6 +23605,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt) + goto internal_error; + } + xmlSchemaItemListAdd(parBind->dupls, parNode); ++ dupls = (xmlSchemaPSVIIDCNodePtr *) ++ parBind->dupls->items; + } else { + /* + * Add the node-table entry (node and key-sequence) of +-- +GitLab + diff --git a/libxml2.spec b/libxml2.spec index a8ad11b..012bab2 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,6 +1,6 @@ Name: libxml2 Version: 2.9.13 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Library providing XML and HTML support License: MIT @@ -26,6 +26,8 @@ Patch8: libxml2-2.11.0-fix-CVE-2023-39615.patch Patch9: libxml2-2.11.6-CVE-2024-25062.patch # https://issues.redhat.com/browse/RHEL-76298 Patch10: libxml2-2.9.13-CVE-2022-49043.patch +# https://issues.redhat.com/browse/RHEL-80127 +Patch11: libxml2-2.9.13-CVE-2024-56171.patch BuildRequires: cmake-rpm-macros BuildRequires: gcc @@ -154,6 +156,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %{python3_sitearch}/libxml2mod.so %changelog +* Tue Feb 25 2025 David King - 2.9.13-8 +- Fix CVE-2024-56171 (RHEL-80127) + * Tue Feb 11 2025 David King - 2.9.13-7 - Fix CVE-2022-49043 (RHEL-76298)