import UBI libxml2-2.9.13-14.el9_8.4
This commit is contained in:
AlmaLinux RelEng Bot
parent
750926d503
commit
eef1f80f05
117
SOURCES/libxml2-2.9.13-CVE-2026-11979.patch
Normal file
117
SOURCES/libxml2-2.9.13-CVE-2026-11979.patch
Normal file
@ -0,0 +1,117 @@
|
||||
From e3b080bac15cbf867888ca246200135601cae4bc Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
|
||||
Date: Fri, 22 May 2026 12:21:20 +0200
|
||||
Subject: [PATCH] xmlcatalog: overflow check for large --shell commands
|
||||
|
||||
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
|
||||
---
|
||||
test/catalogs/test.sh | 58 +++++++++++++++++++++++++++++++++++++++++++
|
||||
xmlcatalog.c | 16 ++++++++++++
|
||||
2 files changed, 74 insertions(+)
|
||||
create mode 100755 test/catalogs/test.sh
|
||||
|
||||
diff --git a/test/catalogs/test.sh b/test/catalogs/test.sh
|
||||
new file mode 100755
|
||||
index 00000000..84e8b90a
|
||||
--- /dev/null
|
||||
+++ b/test/catalogs/test.sh
|
||||
@@ -0,0 +1,58 @@
|
||||
+#!/bin/sh
|
||||
+
|
||||
+echo "## Catalog regression tests"
|
||||
+
|
||||
+if [ -n "$1" ]; then
|
||||
+ xmlcatalog=$1
|
||||
+else
|
||||
+ xmlcatalog=./xmlcatalog
|
||||
+fi
|
||||
+
|
||||
+exitcode=0
|
||||
+
|
||||
+# Test xmlcatalog --shell command line
|
||||
+# Case 1: Really long argument (470 chars)
|
||||
+input=""; for i in {1..470}; do input="${input}A"; done
|
||||
+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
|
||||
+# Case 2: public + long argument
|
||||
+input="public "; for i in {1..470}; do input="${input}A"; done
|
||||
+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
|
||||
+# Case 3: public + lots of args
|
||||
+input="public "; for i in {1..80}; do input="${input} x"; done
|
||||
+echo $input | $xmlcatalog --shell test/catalogs/dockbook.xml || exit 1
|
||||
+
|
||||
+for i in test/catalogs/*.script ; do
|
||||
+ name=$(basename $i .script)
|
||||
+ xml="./test/catalogs/$name.xml"
|
||||
+
|
||||
+ if [ -f $xml ] ; then
|
||||
+ if [ ! -f result/catalogs/$name ] ; then
|
||||
+ echo New test file $name
|
||||
+ $xmlcatalog --shell $xml < $i 2>&1 > result/catalogs/$name
|
||||
+ else
|
||||
+ $xmlcatalog --shell $xml < $i 2>&1 > catalog.out
|
||||
+ log=$(diff result/catalogs/$name catalog.out)
|
||||
+ if [ -n "$log" ] ; then
|
||||
+ echo $name result
|
||||
+ echo "$log"
|
||||
+ exitcode=1
|
||||
+ fi
|
||||
+ rm catalog.out
|
||||
+ fi
|
||||
+ fi
|
||||
+done
|
||||
+
|
||||
+# Add and del operations on XML Catalogs
|
||||
+
|
||||
+$xmlcatalog --create --noout mycatalog
|
||||
+$xmlcatalog --noout --add public Pubid sysid mycatalog
|
||||
+$xmlcatalog --noout --add public Pubid2 sysid2 mycatalog
|
||||
+$xmlcatalog --noout --add public Pubid3 sysid3 mycatalog
|
||||
+diff result/catalogs/mycatalog.full mycatalog
|
||||
+$xmlcatalog --noout --del sysid mycatalog
|
||||
+$xmlcatalog --noout --del sysid3 mycatalog
|
||||
+$xmlcatalog --noout --del sysid2 mycatalog
|
||||
+diff result/catalogs/mycatalog.empty mycatalog
|
||||
+rm -f mycatalog
|
||||
+
|
||||
+exit $exitcode
|
||||
diff --git a/xmlcatalog.c b/xmlcatalog.c
|
||||
index 7b6f3769..2299dc1c 100644
|
||||
--- a/xmlcatalog.c
|
||||
+++ b/xmlcatalog.c
|
||||
@@ -118,6 +118,12 @@ static void usershell(void) {
|
||||
(*cur != '\n') && (*cur != '\r')) {
|
||||
if (*cur == 0)
|
||||
break;
|
||||
+ /* Do not read beyond the command array capacity */
|
||||
+ if (i >= (int)sizeof(command) - 2) {
|
||||
+ printf("Invalid command %s\n", cur);
|
||||
+ i = 0;
|
||||
+ break;
|
||||
+ }
|
||||
command[i++] = *cur++;
|
||||
}
|
||||
command[i] = 0;
|
||||
@@ -135,6 +141,11 @@ static void usershell(void) {
|
||||
while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
|
||||
if (*cur == 0)
|
||||
break;
|
||||
+ if (i >= (int)sizeof(arg) - 2) {
|
||||
+ printf("Invalid arg %s\n", arg);
|
||||
+ i = 0;
|
||||
+ break;
|
||||
+ }
|
||||
arg[i++] = *cur++;
|
||||
}
|
||||
arg[i] = 0;
|
||||
@@ -147,6 +158,11 @@ static void usershell(void) {
|
||||
cur = arg;
|
||||
memset(argv, 0, sizeof(argv));
|
||||
while (*cur != 0) {
|
||||
+ if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
|
||||
+ printf("Too much arguments\n");
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
while ((*cur == ' ') || (*cur == '\t')) cur++;
|
||||
if (*cur == '\'') {
|
||||
cur++;
|
||||
1484
SOURCES/libxml2-2.9.13-CVE-2026-6653.patch
Normal file
1484
SOURCES/libxml2-2.9.13-CVE-2026-6653.patch
Normal file
File diff suppressed because it is too large
Load Diff
@ -1,6 +1,6 @@
|
||||
Name: libxml2
|
||||
Version: 2.9.13
|
||||
Release: 14%{?dist}.2
|
||||
Release: 14%{?dist}.4
|
||||
Summary: Library providing XML and HTML support
|
||||
|
||||
License: MIT
|
||||
@ -48,6 +48,12 @@ Patch19: libxml2-2.9.13-CVE-2024-34459.patch
|
||||
# https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/321
|
||||
# https://redhat.atlassian.net/browse/RHEL-182016
|
||||
Patch20: libxml2-2.12.5-CVE-2025-6170.patch
|
||||
# https://gitlab.gnome.org/GNOME/libxml2/-/commit/463bbeeca1805b5c4828f50d0fefc4eebaf620df
|
||||
# https://issues.redhat.com/browse/RHEL-215619
|
||||
Patch21: libxml2-2.9.13-CVE-2026-6653.patch
|
||||
# https://issues.redhat.com/browse/RHEL-215568
|
||||
# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
|
||||
Patch22: libxml2-2.9.13-CVE-2026-11979.patch
|
||||
|
||||
BuildRequires: cmake-rpm-macros
|
||||
BuildRequires: gcc
|
||||
@ -176,6 +182,12 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz
|
||||
%{python3_sitearch}/libxml2mod.so
|
||||
|
||||
%changelog
|
||||
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.9.13-14.4
|
||||
- Fix CVE-2026-11979 (RHEL-215568)
|
||||
|
||||
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.9.13-14.3
|
||||
- Fix CVE-2026-6653 (RHEL-215619)
|
||||
|
||||
* Tue Jun 16 2026 David King <dking@redhat.com> - 2.9.13-14.2
|
||||
- Fix CVE-2025-6170 (RHEL-182016)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user