From 4df388d2406f66d6028e0cdb5fcfecc0f4ab0f75 Mon Sep 17 00:00:00 2001 From: Christian Hitz Date: Wed, 30 Apr 2025 10:06:23 +0200 Subject: [PATCH] package/libxml2: security bump to version 2.13.8 Fixes the following security vulnerabilities: [CVE-2025-32414] Buffer overflow when parsing text streams with Python API https://gitlab.gnome.org/GNOME/libxml2/-/issues/889 [CVE-2025-32415] Heap-based Buffer Overflow in xmlSchemaIDCFillNodeTables https://gitlab.gnome.org/GNOME/libxml2/-/issues/890 https://www.openwall.com/lists/oss-security/2025/04/17/3 For release notes since 2.13.6, see: https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.7.news https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.8.news Signed-off-by: Christian Hitz [Julien: add links to release notes] Signed-off-by: Julien Olivain (cherry picked from commit 8e1ad23f2a43d860a27208c69d2e8f424324dd84) Signed-off-by: Thomas Perale --- package/libxml2/libxml2.hash | 4 ++-- package/libxml2/libxml2.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libxml2/libxml2.hash b/package/libxml2/libxml2.hash index 88c7f5b9ff..3f53b51b33 100644 --- a/package/libxml2/libxml2.hash +++ b/package/libxml2/libxml2.hash @@ -1,4 +1,4 @@ -# From https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.6.sha256sum -sha256 f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96 libxml2-2.13.6.tar.xz +# From https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.8.sha256sum +sha256 277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a libxml2-2.13.8.tar.xz # License files, locally calculated sha256 c99aae1afe013e50b8b3701e089222b351258043c3025b64053a233fd25b4be7 Copyright diff --git a/package/libxml2/libxml2.mk b/package/libxml2/libxml2.mk index 148fcd8762..789c6a297e 100644 --- a/package/libxml2/libxml2.mk +++ b/package/libxml2/libxml2.mk @@ -5,7 +5,7 @@ ################################################################################ LIBXML2_VERSION_MAJOR = 2.13 -LIBXML2_VERSION = $(LIBXML2_VERSION_MAJOR).6 +LIBXML2_VERSION = $(LIBXML2_VERSION_MAJOR).8 LIBXML2_SOURCE = libxml2-$(LIBXML2_VERSION).tar.xz LIBXML2_SITE = \ https://download.gnome.org/sources/libxml2/$(LIBXML2_VERSION_MAJOR)