Commit Graph

5 Commits

Author SHA1 Message Date
Hongxu Jia
e18f891394 libxml2: fix CVE-2018-9251 and CVE-2018-14567
(From OE-Core rev: b91b276696fb5e0b633b73be408bd750ac4e28ce)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-20 17:38:23 +01:00
Andrej Valek
6b5b26b458 libxml2: Fix CVE-2018-14404
Fix nullptr deref with XPath logic ops

If the XPath stack is corrupted, for example by a misbehaving extension
function, the "and" and "or" XPath operators could dereference NULL
pointers. Check that the XPath stack isn't empty and optimize the
logic operators slightly.

CVE: CVE-2018-14404
(From OE-Core rev: 69315177732a1d260a3315fe8c4c4c44653ae0c8)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-14 11:36:31 +01:00
Changqing Li
67892cc112 libxml2: fix libxml2 ptest fails
for core-image-minimal image,  missing these two dependency
will cause below warning and error:

warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
./test/icu_parse_test.xml generated an error

(From OE-Core rev: 848031cf0b89b752c6fedcb63fc6938642a87fd8)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-02 09:30:11 +01:00
Hongxu Jia
956ddcc9d4 libxml2: fix CVE-2017-8872
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4
allows attackers to cause a denial of service (buffer over-read) or
information disclosure.

https://bugzilla.gnome.org/show_bug.cgi?id=775200

(From OE-Core rev: dac867dc63af70ae992c50697d2be95c3e7b58bb)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-05 11:39:06 +01:00
Andrej Valek
ce8d120bfc libxml2: 2.9.7 -> 2.9.8
(From OE-Core rev: de24ead63802523daa19ce8528ac95d9e041eaf8)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-05-04 13:28:01 +01:00