import UBI libxml2-2.12.5-10.el10_2.3

libxml2-2.12.5-CVE-2026-11979.patch

@@ -0,0 +1,51 @@
+From b175e9b3b701aed0feb39d0ad799015f19e04f59 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 22 May 2026 12:21:20 +0200
+Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
+---
+ xmlcatalog.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/xmlcatalog.c b/xmlcatalog.c
+index 588802b4..51569b87 100644
+--- a/xmlcatalog.c
++++ b/xmlcatalog.c
+@@ -114,6 +114,12 @@ static void usershell(void) {
+ 	       (*cur != '\n') && (*cur != '\r')) {
+ 	    if (*cur == 0)
+ 		break;
++            /* Do not read beyond the command array capacity */
++            if (i >= (int)sizeof(command) - 2) {
++                printf("Invalid command %s\n", cur);
++                i = 0;
++                break;
++            }
+ 	    command[i++] = *cur++;
+ 	}
+ 	command[i] = 0;
+@@ -131,6 +137,11 @@ static void usershell(void) {
+ 	while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
+ 	    if (*cur == 0)
+ 		break;
++            if (i >= (int)sizeof(arg) - 2) {
++                printf("Invalid arg %s\n", arg);
++                i = 0;
++                break;
++            }
+ 	    arg[i++] = *cur++;
+ 	}
+ 	arg[i] = 0;
+@@ -143,6 +154,11 @@ static void usershell(void) {
+ 	cur = arg;
+ 	memset(argv, 0, sizeof(argv));
+ 	while (*cur != 0) {
++            if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
++                printf("Too much arguments\n");
++                break;
++            }
++
+ 	    while ((*cur == ' ') || (*cur == '\t')) cur++;
+ 	    if (*cur == '\'') {
+ 		cur++;

libxml2.spec

@@ -1,6 +1,6 @@
 Name:           libxml2
 Version:        2.12.5
-Release:        10%{?dist}.2
+Release:        10%{?dist}.3
 Summary:        Library providing XML and HTML support
 
 # list.c, dict.c and few others use ISC-Veillard
@@ -44,6 +44,9 @@ Patch12:        libxml2-2.12.5-CVE-2024-34459.patch
 # https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/321
 # https://redhat.atlassian.net/browse/RHEL-182007
 Patch13:        libxml2-2.12.5-CVE-2025-6170.patch
+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
+# https://issues.redhat.com/browse/RHEL-215571
+Patch14:        libxml2-2.12.5-CVE-2026-11979.patch
 
 BuildRequires:  cmake-rpm-macros
 BuildRequires:  gcc
@@ -184,6 +187,9 @@ popd
 %{python3_sitelib}/__pycache__/drv_libxml2.*
 
 %changelog
+* Sat Jul 25 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.12.5-10.3
+- Fix CVE-2026-11979 (RHEL-215571)
+
 * Tue Jun 16 2026 David King <dking@redhat.com> - 2.12.5-10.2
 - Fix CVE-2025-6170 (RHEL-182007)