]> rtime.felk.cvut.cz Git - coffee/buildroot.git/commit
libxml2: security bump to version 2.9.3
authorDanomi Manchego <danomimanchego123@gmail.com>
Sun, 22 Nov 2015 01:38:28 +0000 (20:38 -0500)
committerThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Sun, 22 Nov 2015 12:44:47 +0000 (13:44 +0100)
commit08e08586b579d8a339ed6f1e3da01676fa3a7010
treea3d13220e1f1d394dc33e616ce890528c52f2be0
parentb18e4b58499a90694b2447db4e4ceef3af8d897c
libxml2: security bump to version 2.9.3

- Fixes:
  - CVE-2015-5312 - Another entity expansion issue
  - CVE-2015-7497 - Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-7500 - Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 - Buffer overead with HTML parser in push mode

- Incorporates upstreamed patches as well, which also fixed:
  - CVE-2015-1819 - The xmlreader in libxml allows remote attackers to cause
    a denial of service (memory consumption) via crafted XML data, related
    to an XML Entity Expansion (XEE) attack.
  - CVE-2015-7941 - out-of-bounds memory access.
  - CVE-2015-7942 - heap-buffer-overflow in xmlParseConditionalSections.
  - CVE-2015-8035 - DoS via crafted xz file.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
package/libxml2/0001-libxml2-config.cmake.in-update-include-directories.patch [deleted file]
package/libxml2/0002-threads-use-forward-declarations-only-for-glibc.patch [deleted file]
package/libxml2/0003-fix-CVE-2015-1819.patch [deleted file]
package/libxml2/0004-fix-CVE-2015-7941-1.patch [deleted file]
package/libxml2/0005-fix-CVE-2015-7941-2.patch [deleted file]
package/libxml2/0006-fix-CVE-2015-7942-1.patch [deleted file]
package/libxml2/0007-fix-CVE-2015-7942-2.patch [deleted file]
package/libxml2/0008-fix-CVE-2015-8035.patch [deleted file]
package/libxml2/libxml2.hash
package/libxml2/libxml2.mk