diff options
| author | Efraim Flashner <efraim@flashner.co.il> | 2017-10-01 19:59:55 +0300 |
|---|---|---|
| committer | Efraim Flashner <efraim@flashner.co.il> | 2017-10-01 22:16:22 +0300 |
| commit | 64df08f0cfac8f7a329002afa3461fd62a4b229c (patch) | |
| tree | 019909423138ceb49cdd86f1af48d366503db68f /gnu/packages/patches/libxml2-CVE-2017-7375.patch | |
| parent | b83ad3ace56c65a367e8f58c7b78323cf251b94b (diff) | |
| parent | 0ef1c223071869488c35b72b7407234c11425589 (diff) | |
| download | guix-patches-64df08f0cfac8f7a329002afa3461fd62a4b229c.tar guix-patches-64df08f0cfac8f7a329002afa3461fd62a4b229c.tar.gz | |
Merge remote-tracking branch 'origin/master' into core-updates
Diffstat (limited to 'gnu/packages/patches/libxml2-CVE-2017-7375.patch')
| -rw-r--r-- | gnu/packages/patches/libxml2-CVE-2017-7375.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/gnu/packages/patches/libxml2-CVE-2017-7375.patch b/gnu/packages/patches/libxml2-CVE-2017-7375.patch new file mode 100644 index 0000000000..32af1ff6ba --- /dev/null +++ b/gnu/packages/patches/libxml2-CVE-2017-7375.patch @@ -0,0 +1,45 @@ +Fix CVE-2017-7375: + +https://bugzilla.gnome.org/show_bug.cgi?id=780691 (not yet public) +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375 +https://security-tracker.debian.org/tracker/CVE-2017-7375 + +Patch copied from upstream source repository: + +https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e + +From 90ccb58242866b0ba3edbef8fe44214a101c2b3e Mon Sep 17 00:00:00 2001 +From: Neel Mehta <nmehta@google.com> +Date: Fri, 7 Apr 2017 17:43:02 +0200 +Subject: [PATCH] Prevent unwanted external entity reference + +For https://bugzilla.gnome.org/show_bug.cgi?id=780691 + +* parser.c: add a specific check to avoid PE reference +--- + parser.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/parser.c b/parser.c +index 609a2703..c2c812de 100644 +--- a/parser.c ++++ b/parser.c +@@ -8123,6 +8123,15 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt) + if (xmlPushInput(ctxt, input) < 0) + return; + } else { ++ if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && ++ ((ctxt->options & XML_PARSE_NOENT) == 0) && ++ ((ctxt->options & XML_PARSE_DTDVALID) == 0) && ++ ((ctxt->options & XML_PARSE_DTDLOAD) == 0) && ++ ((ctxt->options & XML_PARSE_DTDATTR) == 0) && ++ (ctxt->replaceEntities == 0) && ++ (ctxt->validate == 0)) ++ return; ++ + /* + * TODO !!! + * handle the extra spaces added before and after +-- +2.14.1 + |