https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=256094
--- Comment #5 from [email protected] --- A commit in branch 2021Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=d1aa619eee6b57face171474c3166f4112447f26 commit d1aa619eee6b57face171474c3166f4112447f26 Author: Yasuhiro Kimura <[email protected]> AuthorDate: 2021-05-23 14:27:31 +0000 Commit: Tobias C. Berner <[email protected]> CommitDate: 2021-05-23 14:35:28 +0000 textproc/libxml2: add upstream fix for CVE-2021-3541 This is relapted to parameter entities expansion and following the line of the billion laugh attack. Somehow in that path the counting of parameters was missed and the normal algorithm based on entities "density" was useless. PR: 256094 Obtained from: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e Security: CVE-2021-3541 (cherry picked from commit 83889bd6875d128b44342dd3cd58fe6027b98542) textproc/libxml2/Makefile | 2 +- textproc/libxml2/files/patch-CVE-2021-3541 (new) | 67 ++++++++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-) -- You are receiving this mail because: You are the assignee for the bug.
