mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libxml2: CVE-2018-14404

Browse Source 
* CVE-2018-14404
A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval()
function of libxml2 when parsing invalid XPath expression. Applications processing
untrusted XSL format inputs with the use of libxml2 library may be vulnerable to
denial of service attack due to crash of the application.

Affects libxml <= 2.9.8

CVE: CVE-2018-14404
Ref: https://access.redhat.com/security/cve/cve-2018-14404

(From OE-Core rev: 06d7f9039b005c2112e28336ac1c30e5120ec815)

Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Sinan Kaya
2018-10-05 00:39:07 +00:00
committed by Richard Purdie
parent 967d42170e
commit 536412ec4d
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-core/libxml/libxml2_2.9.7.bb
View File

@@ -21,6 +21,7 @@ SRC_URI = "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \
file://libxml-m4-use-pkgconfig.patch \
file://0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch \
file://fix-execution-of-ptests.patch \
file://CVE-2018-14404.patch \
"
SRC_URI[libtar.md5sum] = "896608641a08b465098a40ddf51cefba"