Control: reopen -1 Control: found -1 2.8.0+dfsg1-7+wheezy3 Hello,
This is still an issue in stable, the proposed patch was not applied there, and thus installation-guide still FTBFS on wheezy, notably on our dillon.debian.org machine, thus making http://d-i.debian.org/manual/ completely out of date. Could this be proposed for stable update? I have attached the proposed patch again. Samuel
--- libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch.original 2015-01-01 14:48:26.337554556 +0100 +++ libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch 2015-01-01 14:48:53.000874666 +0100 @@ -6,11 +6,11 @@ parser.c | 42 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) -diff --git a/parser.c b/parser.c -index 7ef712d..b435913 100644 ---- a/parser.c -+++ b/parser.c -@@ -127,6 +127,29 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2015-01-01 13:20:23.913738969 +0000 ++++ libxml2-2.8.0+dfsg1/parser.c 2015-01-01 13:47:31.930940787 +0000 +@@ -127,6 +127,27 @@ return (0); if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) return (1); @@ -29,10 +29,8 @@ + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, 0, 0, 0); + -+ ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; ++ ent->checked = ctxt->nbentities - oldnbent + 1; + if (rep != NULL) { -+ if (xmlStrchr(rep, '<')) -+ ent->checked |= 1; + xmlFree(rep); + rep = NULL; + }