This isn't a backport, it's just a patch that is in bugzilla so should be marked as Submitted.
Ross On 3 July 2018 at 09:10, Hongxu Jia <hongxu....@windriver.com> wrote: > The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 > allows attackers to cause a denial of service (buffer over-read) or > information disclosure. > > https://bugzilla.gnome.org/show_bug.cgi?id=775200 > > Signed-off-by: Hongxu Jia <hongxu....@windriver.com> > --- > .../libxml/libxml2/fix-CVE-2017-8872.patch | 38 > ++++++++++++++++++++++ > meta/recipes-core/libxml/libxml2_2.9.8.bb | 1 + > 2 files changed, 39 insertions(+) > create mode 100644 meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch > > diff --git a/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch > b/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch > new file mode 100644 > index 0000000..e34a48e > --- /dev/null > +++ b/meta/recipes-core/libxml/libxml2/fix-CVE-2017-8872.patch > @@ -0,0 +1,38 @@ > +From b4bee17b158e289e5c4c9045e64e5374ccafe068 Mon Sep 17 00:00:00 2001 > +From: Salvatore Bonaccorso <car...@debian.org> > +Date: Tue, 3 Jul 2018 15:54:03 +0800 > +Subject: [PATCH] Out-of-bounds read in htmlParseTryOrFinish (CVE-2017-8872) > + > +https://bugzilla.gnome.org/show_bug.cgi?id=775200 > +Fixes bug 775200. > + > +Signed-off-by: Salvatore Bonaccorso <car...@debian.org> > + > +Upstream-Status: Backport > +https://bug775200.bugzilla-attachments.gnome.org/attachment.cgi?id=366193 > +CVE: CVE-2017-8872 > +Signed-off-by: Hongxu Jia <hongxu....@windriver.com> > +--- > + parser.c | 6 +++++- > + 1 file changed, 5 insertions(+), 1 deletion(-) > + > +diff --git a/parser.c b/parser.c > +index ca9fde2..fb4c889 100644 > +--- a/parser.c > ++++ b/parser.c > +@@ -12464,7 +12464,11 @@ xmlHaltParser(xmlParserCtxtPtr ctxt) { > + } > + ctxt->input->cur = BAD_CAST""; > + ctxt->input->base = ctxt->input->cur; > +- ctxt->input->end = ctxt->input->cur; > ++ ctxt->input->end = ctxt->input->cur; > ++ if (ctxt->input->buf) > ++ xmlBufEmpty (ctxt->input->buf->buffer); > ++ else > ++ ctxt->input->length = 0; > + } > + } > + > +-- > +2.7.4 > + > diff --git a/meta/recipes-core/libxml/libxml2_2.9.8.bb > b/meta/recipes-core/libxml/libxml2_2.9.8.bb > index d55e650..1f22bb0 100644 > --- a/meta/recipes-core/libxml/libxml2_2.9.8.bb > +++ b/meta/recipes-core/libxml/libxml2_2.9.8.bb > @@ -20,6 +20,7 @@ SRC_URI = > "http://www.xmlsoft.org/sources/libxml2-${PV}.tar.gz;name=libtar \ > file://libxml-m4-use-pkgconfig.patch \ > > file://0001-Make-ptest-run-the-python-tests-if-python-is-enabled.patch \ > file://fix-execution-of-ptests.patch \ > + file://fix-CVE-2017-8872.patch \ > " > > SRC_URI[libtar.md5sum] = "b786e353e2aa1b872d70d5d1ca0c740d" > -- > 2.7.4 > -- _______________________________________________ Openembedded-core mailing list Openembedded-core@lists.openembedded.org http://lists.openembedded.org/mailman/listinfo/openembedded-core