From patchwork Sun Apr 26 11:44:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 9731 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4g3PyH0xYBz3xNb for ; Sun, 26 Apr 2026 11:45:11 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4g3PyG5cYPz7Gl for ; Sun, 26 Apr 2026 11:45:10 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4g3Pxy4Cvmz37TG for ; Sun, 26 Apr 2026 11:44:54 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4g3Pxp3TS2z34Vt for ; Sun, 26 Apr 2026 11:44:46 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4g3Pxn6vyYz79C; Sun, 26 Apr 2026 11:44:45 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1777203886; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Wul4zX4g2A5BIpG0KWm8K45mUkPkPHpZ+CY2/Ys+V38=; b=ne1wm74q3ItNRnIxdPSqHIy8tLz4NEEj134T/DbtUPhxNF5fQguRqag3saibC9GTbA6bnT v+LgDvT+xBey+lBg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1777203886; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Wul4zX4g2A5BIpG0KWm8K45mUkPkPHpZ+CY2/Ys+V38=; b=XH10UDudnLVFforT2HsMpqH9IXoQ5YubFDf/TSl5Mv2CXMSMVPy75yTBLZKyIiMx0Ihx1N +zYcMcuE2p0nkaauucz8RNNOu3tKQodcUtsXtq1hyCp5damELGZKGV48pezEWBfo3cgTo4 zm0gnDgfPV0RIUqG6kmpKywFKPPEJ8jiRC40mHsug0EoFU9uLGFmgNTOlm+H5F1IoV43Rn 3Hx92W8D322EbIMSco/fIDfKHoU2kVDnBgQZ/O4aWGggXrGKaeYleMpw+eUyMkFpXFDdzI 0T/FvgfZI9G7Fvr2Zm2nEcODECRRvcep1KdiOCn8AZpEoeEWghb4cUc3bCuI7w== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] libxml2: Update to version 2.15.3 Date: Sun, 26 Apr 2026 13:44:15 +0200 Message-ID: <20260426114418.122889-26-adolf.belka@ipfire.org> In-Reply-To: <20260426114418.122889-1-adolf.belka@ipfire.org> References: <20260426114418.122889-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.15.1 to 2.15.3 - Update of rootfile - Five CVE fixes applied in 2.15.2 - Changelog 2.15.3 Security - parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion) - entities: copy children in xmlCopyEntity - c14n: Fix Type confusion in xmlC14NProcessAttrsAxis - python: Do not decref string after adding to the list (double-free / use-after-free) - c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free) Improvements - schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode - xmlreader: propagate reader resource loaders to validator parsers - python: Make python bindings python2 compatible - xmlregexp: Fix escape-sequence character range matching - xmlreader: Free input in xmlReaderForFd (memory-leak) - xmlstring: Free cur on every error for xmlStrncat (memory-leak) - catalog: Free xmlCatalogResolveCache on cleanup (memory leak) - Fix nanohttp.c build when --without-output - test: fix mismatched signed/unsigned comparison 2.15.2 Security - CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c - CVE-2026-0990 fix: Prevent infinite recursion in xmlCatalogListXMLResolve - CVE-2026-0992 fix: Exponential behavior when handling - parser: Fix infinite loop in xmlCtxtParseContent - CVE-2025-10911 libxslt related: Ignore next/prev of documents when traversing XPath - CVE-2026-0989 fix: Add RelaxNG include limit - xmlIO: use size_t for buffer size reallocation - uri: fix signed integer overflow in xmlBuildRelativeURISafe - schematron: fix memory leaks on error paths in xmlSchematronParseRule - catalog: fix stack overflow from self-referencing SGML CATALOG entries Improvements - fuzz: Make fuzzy encoding match more lenient - Fix C14N type confusion - meson: Fix build with Meson < 1.3 - xmllint: Use zlib directly - xmllint: New option to separate xpath results using null, --xpath0 - autotools: Make valgrind actually check for leaks - meson: Add valgrind test setup - Fix xmlOutputBufferGetContent output when encoder is set - threads: don't force _WIN32_WINNT to Vista if it's set to a higher value - dist: Add generated documentation to the dist as "dist-doc" folder to simplify downstream packaging of doc - Fix xmlRemoveEntity removing from wrong hash table - use duplicating variant in relaxng to mitigate UAF - Fix memory leak in xmlTextWriterStartAttributeNS on OOM - meson: remove hardcoded buildtype=debug default - Fix memory leak of prefix in xmlTextWriterStartElementNS() - writer: Add a few extra NULL checks to avoid memory leaks on corrupt writer path. Signed-off-by: Adolf Belka --- config/rootfiles/common/libxml2 | 2 +- lfs/libxml2 | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/libxml2 b/config/rootfiles/common/libxml2 index 779b249ea..5a4f85793 100644 --- a/config/rootfiles/common/libxml2 +++ b/config/rootfiles/common/libxml2 @@ -54,5 +54,5 @@ #usr/lib/libxml2.la #usr/lib/libxml2.so usr/lib/libxml2.so.16 -usr/lib/libxml2.so.16.1.1 +usr/lib/libxml2.so.16.1.3 #usr/lib/pkgconfig/libxml-2.0.pc diff --git a/lfs/libxml2 b/lfs/libxml2 index c1ea739eb..84ebb0a0a 100644 --- a/lfs/libxml2 +++ b/lfs/libxml2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2025 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.15.1 +VER = 2.15.3 # https://download.gnome.org/sources/libxml2/ THISAPP = libxml2-$(VER) @@ -43,7 +43,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 73c4d17adacda67d71c5a120c7de2324df1db35963cadbe18166dafe122e1f10dcab9d4fed0e128c077a5ca31432bfaf72f742c42680251660d397ab8bc3538b +$(DL_FILE)_BLAKE2 = 2ff478b46a40957386cd1ed0627bfc0f2433f47e786f20db3942304c90289adaeb1d9c3f12665df312b86cfac42f8e4dbc18e965bf90018f93c230b9b862df66 install : $(TARGET)