From unknown Sat Aug 16 16:02:12 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#30099 <30099@debbugs.gnu.org> To: bug#30099 <30099@debbugs.gnu.org> Subject: Status: [PATCH 1/2] gnu: libxml2: Fix CVE-2017-15412. Reply-To: bug#30099 <30099@debbugs.gnu.org> Date: Sat, 16 Aug 2025 23:02:12 +0000 retitle 30099 [PATCH 1/2] gnu: libxml2: Fix CVE-2017-15412. reassign 30099 guix-patches submitter 30099 Leo Famulari severity 30099 normal tag 30099 patch thanks From debbugs-submit-bounces@debbugs.gnu.org Sat Jan 13 13:09:23 2018 Received: (at submit) by debbugs.gnu.org; 13 Jan 2018 18:09:23 +0000 Received: from localhost ([127.0.0.1]:55097 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1eaQF4-00039n-Fg for submit@debbugs.gnu.org; Sat, 13 Jan 2018 13:09:23 -0500 Received: from eggs.gnu.org ([208.118.235.92]:39372) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1eaQF1-00039N-F0 for submit@debbugs.gnu.org; Sat, 13 Jan 2018 13:09:17 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eaQEv-0002cj-9J for submit@debbugs.gnu.org; Sat, 13 Jan 2018 13:09:10 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:58811) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eaQEv-0002cW-55 for submit@debbugs.gnu.org; Sat, 13 Jan 2018 13:09:09 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58526) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eaQEt-00086F-UB for guix-patches@gnu.org; Sat, 13 Jan 2018 13:09:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eaQEq-0002Wk-HZ for guix-patches@gnu.org; Sat, 13 Jan 2018 13:09:07 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:39005) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eaQEq-0002W0-Da for guix-patches@gnu.org; Sat, 13 Jan 2018 13:09:04 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 2B4CB20D1A; Sat, 13 Jan 2018 13:09:04 -0500 (EST) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Sat, 13 Jan 2018 13:09:04 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc; s=mesmtp; bh=SWU/Ew7O4SNZNV4LACeq5XqSi4Cn4x3pIKIgBi +8qZw=; b=WrZtzhsJOJxKhcg3gRjY+/U5nORI5Vn/bla/w8KQapczoGwm3micOj O0RdvobM/oNG/w1kKCLtfQzysI2UlX5NmXekC0dLuWAL5Kt2WL39/Y6qPX/XoY4Q Yhz5sxfTgd+pGhhO//buh+1lOqw3vwAhPYXSV6rZ4uoLghSBRz44M= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=SWU/Ew7O4SNZNV4LA Ceq5XqSi4Cn4x3pIKIgBi+8qZw=; b=sIvoDi06xRGWuEP6qVbcRZEkUZoejz+V/ /5bgl+sVjJSD6GSKqc6Gjg+rmLLYGYtC4OZ9syL1QyPOO9u6NqZJDIbw15idYEx7 rAMSZxcn2OwQduvLrNzERKMdrKPnyYVsJwQqKM0Q8/zOvC7O/tDjntTkvSPaIpmf N6QVjMm3OxMNvu2TkYPJbfhn5XFMbmW64AW1eaAehKnjxL9NZLdWhhw+aO1tBB/I N7kE96rpWM9Gz+L0G0As9zDJMjDL+tYZ+Kp8CYoofPl10L0lApgF/Ou0rgajBRG2 rg5R+Ym9kAvsA0le/+IWyMbyusr0/dzJ6f7MFE89TqF2eCJQWnENQ== X-ME-Sender: Received: from jasmine.lan (unknown [162.208.95.194]) by mail.messagingengine.com (Postfix) with ESMTPA id C0D4324235 for ; Sat, 13 Jan 2018 13:09:03 -0500 (EST) From: Leo Famulari To: guix-patches@gnu.org Subject: [PATCH 1/2] gnu: libxml2: Fix CVE-2017-15412. Date: Sat, 13 Jan 2018 10:08:53 -0800 Message-Id: X-Mailer: git-send-email 2.15.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.9 (/) * gnu/packages/patches/libxml2-CVE-2017-15412.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/xml.scm (libxml2/fixed)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/patches/libxml2-CVE-2017-15412.patch | 47 +++++++++++++++++++++++ gnu/packages/xml.scm | 3 +- 3 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 gnu/packages/patches/libxml2-CVE-2017-15412.patch diff --git a/gnu/local.mk b/gnu/local.mk index 6af8bfc4b..bea676c04 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -860,6 +860,7 @@ dist_patch_DATA = \ %D%/packages/patches/libxml2-CVE-2017-7376.patch \ %D%/packages/patches/libxml2-CVE-2017-9047+CVE-2017-9048.patch \ %D%/packages/patches/libxml2-CVE-2017-9049+CVE-2017-9050.patch \ + %D%/packages/patches/libxml2-CVE-2017-15412.patch \ %D%/packages/patches/libxslt-generated-ids.patch \ %D%/packages/patches/libxslt-CVE-2016-4738.patch \ %D%/packages/patches/libxslt-CVE-2017-5029.patch \ diff --git a/gnu/packages/patches/libxml2-CVE-2017-15412.patch b/gnu/packages/patches/libxml2-CVE-2017-15412.patch new file mode 100644 index 000000000..07fe190ed --- /dev/null +++ b/gnu/packages/patches/libxml2-CVE-2017-15412.patch @@ -0,0 +1,47 @@ +Fix CVE-2017-15412: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412 +https://bugs.chromium.org/p/chromium/issues/detail?id=727039 +https://bugzilla.redhat.com/show_bug.cgi?id=1523128 +https://bugzilla.gnome.org/show_bug.cgi?id=783160 + +Patch copied from upstream source repository: + +https://git.gnome.org/browse/libxml2/commit/?id=0f3b843b3534784ef57a4f9b874238aa1fda5a73 + +From 0f3b843b3534784ef57a4f9b874238aa1fda5a73 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Thu, 1 Jun 2017 23:12:19 +0200 +Subject: [PATCH] Fix XPath stack frame logic + +Move the calls to xmlXPathSetFrame and xmlXPathPopFrame around in +xmlXPathCompOpEvalPositionalPredicate to make sure that the context +object on the stack is actually protected. Otherwise, memory corruption +can occur when calling sloppily coded XPath extension functions. + +Fixes bug 783160. +--- + xpath.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/xpath.c b/xpath.c +index 94815075..b816bd36 100644 +--- a/xpath.c ++++ b/xpath.c +@@ -11932,11 +11932,11 @@ xmlXPathCompOpEvalPositionalPredicate(xmlXPathParserContextPtr ctxt, + } + } + +- frame = xmlXPathSetFrame(ctxt); + valuePush(ctxt, contextObj); ++ frame = xmlXPathSetFrame(ctxt); + res = xmlXPathCompOpEvalToBoolean(ctxt, exprOp, 1); +- tmp = valuePop(ctxt); + xmlXPathPopFrame(ctxt, frame); ++ tmp = valuePop(ctxt); + + if ((ctxt->error != XPATH_EXPRESSION_OK) || (res == -1)) { + while (tmp != contextObj) { +-- +2.15.1 + diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm index 23b447502..ce0d13a99 100644 --- a/gnu/packages/xml.scm +++ b/gnu/packages/xml.scm @@ -155,7 +155,8 @@ project (but it is usable outside of the Gnome platform).") "libxml2-CVE-2017-7375.patch" "libxml2-CVE-2017-7376.patch" "libxml2-CVE-2017-9047+CVE-2017-9048.patch" - "libxml2-CVE-2017-9049+CVE-2017-9050.patch"))))))) + "libxml2-CVE-2017-9049+CVE-2017-9050.patch" + "libxml2-CVE-2017-15412.patch"))))))) (define-public python-libxml2 (package (inherit libxml2) -- 2.15.1 From debbugs-submit-bounces@debbugs.gnu.org Tue Jan 16 09:31:17 2018 Received: (at 30099) by debbugs.gnu.org; 16 Jan 2018 14:31:17 +0000 Received: from localhost ([127.0.0.1]:58212 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ebSGi-0000tp-T3 for submit@debbugs.gnu.org; Tue, 16 Jan 2018 09:31:17 -0500 Received: from hera.aquilenet.fr ([185.233.100.1]:54278) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ebSGf-0000tf-Ja for 30099@debbugs.gnu.org; Tue, 16 Jan 2018 09:31:16 -0500 Received: from localhost (localhost [127.0.0.1]) by hera.aquilenet.fr (Postfix) with ESMTP id 255BD10DA4; Tue, 16 Jan 2018 15:31:13 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at aquilenet.fr Received: from hera.aquilenet.fr ([127.0.0.1]) by localhost (hera.aquilenet.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BEUWeF6yDFn5; Tue, 16 Jan 2018 15:31:11 +0100 (CET) Received: from ribbon (unknown [193.50.110.60]) by hera.aquilenet.fr (Postfix) with ESMTPSA id BD0BC10DA2; Tue, 16 Jan 2018 15:31:11 +0100 (CET) From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: Leo Famulari Subject: Re: [bug#30099] [PATCH 1/2] gnu: libxml2: Fix CVE-2017-15412. References: X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 27 =?utf-8?Q?Niv=C3=B4se?= an 226 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x090B11993D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-pc-linux-gnu Date: Tue, 16 Jan 2018 15:31:11 +0100 In-Reply-To: (Leo Famulari's message of "Sat, 13 Jan 2018 10:08:53 -0800") Message-ID: <87h8rl6fkg.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: 30099 Cc: 30099@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.0 (+) Leo Famulari skribis: > * gnu/packages/patches/libxml2-CVE-2017-15412.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/xml.scm (libxml2/fixed)[source]: Use it. [...] > Previously, python-libxml2 would inherit the ungrafted libxml2, missing > several patches on the libxml2 source code. > > * gnu/packages/xml.scm (python-libxml2, python2-libxml2): Use > package/inherit. LGTM, thanks! Ludo'. From debbugs-submit-bounces@debbugs.gnu.org Tue Jan 16 13:38:06 2018 Received: (at control) by debbugs.gnu.org; 16 Jan 2018 18:38:06 +0000 Received: from localhost ([127.0.0.1]:59050 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ebW7Z-0002Xf-SA for submit@debbugs.gnu.org; Tue, 16 Jan 2018 13:38:05 -0500 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:49799) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ebW7X-0002XX-N4 for control@debbugs.gnu.org; Tue, 16 Jan 2018 13:38:03 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 1A3E220C87; Tue, 16 Jan 2018 13:38:03 -0500 (EST) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Tue, 16 Jan 2018 13:38:03 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:to:x-me-sender :x-me-sender:x-sasl-enc; s=mesmtp; bh=XL3Q9oam809y7XUWz1KhQskmd6 llDUJOVeoSmyd1H0s=; b=bUrO2k0BK5sECLs5ZndFk1YRP1Hzp2X3cSJU0EH2U1 eiSooetwSndnk+f1/nyw2gaWOBpsO1eSTU1C55B8okNYjWVQp4I5kL2kzo5S8FPg N4QkuxJapDsRVNIVwQhAwagGZ0YNJCHOw4w3Qz+NhWqi/kQuA6NdO7okGsi4tOne M= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=X L3Q9oam809y7XUWz1KhQskmd6llDUJOVeoSmyd1H0s=; b=bBiIkjDq7Q2TproJ5 oGAIfL15RGKJpf+YK9IHAkrFrBp8SdFajsBoEpRa4bCJ03gHA8yyp3b45B39sfCh Yc65Or/M1n6ntc1ORU1u1xBYlEZNzEKM/GhlSakLOC0YyT+rQAFqeXDuwXCvwc0W 3iQ0GOcUNpEIUJNiveWHtmU6vBKvQDVNRufC8VbEfgrM62CQ7xOmymXNFNc56bCa FJfyKL9QS2qlND1kyB4rG1ZbWyLmmLrVN+C1i5f/uJ8zOoMf0rBK5Aq4TLv8LXQa TC9giNvLzs/lL+JOu35tnSMlqDnfhZrp7F+Ml4salTNu74URM9kGtAG+hd0pv8Iu jT6Iw== X-ME-Sender: Received: from localhost (71-93-196-183.dhcp.nrwl.ca.charter.com [71.93.196.183]) by mail.messagingengine.com (Postfix) with ESMTPA id A6C2D240DF for ; Tue, 16 Jan 2018 13:38:02 -0500 (EST) Date: Tue, 16 Jan 2018 10:38:00 -0800 From: Leo Famulari To: control@debbugs.gnu.org Message-ID: <20180116183800.GA15502@jasmine.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.9.2 (2017-12-15) X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: close 30099 [...] Content analysis details: (1.3 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_PASS SPF: sender matches SPF record -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [66.111.4.25 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [66.111.4.25 listed in wl.mailspike.net] 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: close 30099 [...] Content analysis details: (1.3 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [66.111.4.25 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [66.111.4.25 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject 0.0 TVD_SPACE_RATIO No description available. -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid close 30099 From unknown Sat Aug 16 16:02:12 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Wed, 14 Feb 2018 12:24:06 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator