Control: tags 862450 + patch Control: tags 862450 + pending Dear maintainer, hi Mattia
I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-6.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards, Salvatore
diff -Nru libxml2-2.9.4+dfsg1/debian/changelog libxml2-2.9.4+dfsg1/debian/changelog --- libxml2-2.9.4+dfsg1/debian/changelog 2018-01-02 00:54:05.000000000 +0100 +++ libxml2-2.9.4+dfsg1/debian/changelog 2018-01-02 08:59:03.000000000 +0100 @@ -1,3 +1,11 @@ +libxml2 (2.9.4+dfsg1-6.1) unstable; urgency=medium + + * Non-maintainer upload. + * Out-of-bounds read in htmlParseTryOrFinish (CVE-2017-8872) + (Closes: #862450) + + -- Salvatore Bonaccorso <car...@debian.org> Tue, 02 Jan 2018 08:59:03 +0100 + libxml2 (2.9.4+dfsg1-6) unstable; urgency=medium * Team upload. diff -Nru libxml2-2.9.4+dfsg1/debian/patches/0019-CVE-2017-8872.patch libxml2-2.9.4+dfsg1/debian/patches/0019-CVE-2017-8872.patch --- libxml2-2.9.4+dfsg1/debian/patches/0019-CVE-2017-8872.patch 1970-01-01 01:00:00.000000000 +0100 +++ libxml2-2.9.4+dfsg1/debian/patches/0019-CVE-2017-8872.patch 2018-01-02 08:59:03.000000000 +0100 @@ -0,0 +1,24 @@ +Description: Out-of-bounds read in htmlParseTryOrFinish +Origin: vendor, https://bugzilla.novell.com/attachment.cgi?id=732309 +Bug: https://bugzilla.gnome.org/show_bug.cgi?id=775200 +Bug-Debian: https://bugs.debian.org/862450 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-8872 +Bug-SUSE: https://bugzilla.novell.com/show_bug.cgi?id=1038444 +Forwarded: yes, https://bug775200.bugzilla-attachments.gnome.org/attachment.cgi?id=355527 +Author: Marcus Meissner <meiss...@suse.de> +Reviewed-by: Salvatore Bonaccorso <car...@debian.org> +Last-Update: 2018-01-02 + +--- a/parser.c ++++ b/parser.c +@@ -12725,6 +12725,10 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) { + } + ctxt->input->cur = BAD_CAST""; + ctxt->input->base = ctxt->input->cur; ++ if (ctxt->input->buf) { ++ xmlBufEmpty (ctxt->input->buf->buffer); ++ } else ++ ctxt->input->length = 0; + } + } + diff -Nru libxml2-2.9.4+dfsg1/debian/patches/series libxml2-2.9.4+dfsg1/debian/patches/series --- libxml2-2.9.4+dfsg1/debian/patches/series 2018-01-02 00:54:01.000000000 +0100 +++ libxml2-2.9.4+dfsg1/debian/patches/series 2018-01-02 08:59:03.000000000 +0100 @@ -16,3 +16,4 @@ 0016-Fix-copy-paste-errors-in-error-messages.patch 0017-python-remove-single-use-of-_PyVerify_fd.patch 0018-Fix-XPath-stack-frame-logic.patch +0019-CVE-2017-8872.patch
