Bug 905399 – <dev-libs/libxml2-2.11.1: Multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2023-05-01 06:21:35 UTC]

From NEWS:
"""
+v2.11.0: Apr 28 2023
+
+### Major changes
+
+Protection against entity expansion attacks, also known as "billion laughs"
+has been greatly improved. Malicious files should be detected reliably now
+and false positives should be reduced. It is possible though that large
+documents which make heavy use of entities are rejected now.
+
[...]
+### Security
+
+- Fix use-after-free in xmlParseContentInternal() (David Kilzer)
+- xmllint: Fix use-after-free with --maxmem
+- parser: Fix OOB read when formatting error message
+- entities: Rework entity amplification checks
[...]
"""

[Comment 1 Sam James 2023-05-01 06:22:06 UTC]

This version is currently masked for testing.

Alpine already had to fix a bunch of test failures (or skip stuff for now).

# Sam James <[e-mail]> (2023-05-01)
# Masked for testing. Other distros seem to have hit a bunch of new test
# failures in various applications, and initially there were ABI issues in .0.
>=dev-libs/libxml2-2.11.0

[Comment 2 Sam James 2023-05-10 19:45:57 UTC]

commit 9b2ad65342b2445a38775260e7f4497d06466ee4
Author: Sam James <[e-mail]>
Date:   Wed May 10 20:33:44 2023 +0100

    profiles: unmask new libxml2

    Seems to have fixed the python bindings issue too: https://gitlab.gnome.org/GNOME/libxml2/-/commit/76c6da420923f2721a2e16adfcef8707a2454a1b.

    Closes: https://bugs.gentoo.org/745162
    Signed-off-by: Sam James <[e-mail]>

[Comment 3 Larry the Git Cow 2023-05-19 00:30:34 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=64f596cbb52d0955503281d6998154eacb48d065

commit 64f596cbb52d0955503281d6998154eacb48d065
Author:     Sam James <[e-mail]>
AuthorDate: 2023-05-19 00:29:27 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-05-19 00:29:27 +0000

    dev-libs/libxml2: add 2.11.4
    
    This _might_ fix the LibreOffice issue.
    
    Bug: https://bugs.gentoo.org/905399
    Bug: https://bugs.gentoo.org/906206
    Signed-off-by: Sam James <[e-mail]>

 dev-libs/libxml2/Manifest              |   1 +
 dev-libs/libxml2/libxml2-2.11.4.ebuild | 195 +++++++++++++++++++++++++++++++++
 2 files changed, 196 insertions(+)

[Comment 4 Larry the Git Cow 2023-05-20 07:18:42 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=74742dfaadb00f833e7c786c9ea99e0c5e165176

commit 74742dfaadb00f833e7c786c9ea99e0c5e165176
Author:     Sam James <[e-mail]>
AuthorDate: 2023-05-20 07:17:48 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-05-20 07:17:48 +0000

    profiles: mask intermediate bad libxml2-2.11.* (before <2.11.4)
    
    >=2.11.4 is fine, just 2.11.1 up to 2.11.3 were buggy. Mask to avoid
    confusing bug reports.
    
    Bug: https://bugs.gentoo.org/906206
    Bug: https://bugs.gentoo.org/905399
    Signed-off-by: Sam James <[e-mail]>

 profiles/package.mask | 7 +++++++
 1 file changed, 7 insertions(+)

[Comment 5 Hans de Graaff 2023-12-02 09:04:37 UTC]

I've just removed the dev-ruby/nokogiri versions that required libxml-2.10 specifically, so the vulnerable versions can now be removed.

[Comment 6 Larry the Git Cow 2023-12-28 03:43:02 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=889ba46a2e07a740429cf26c3472ba6f6d527a2f

commit 889ba46a2e07a740429cf26c3472ba6f6d527a2f
Author:     Sam James <[e-mail]>
AuthorDate: 2023-12-28 03:37:49 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-12-28 03:37:49 +0000

    dev-libs/libxml2: drop 2.10.4, 2.11.4
    
    Bug: https://bugs.gentoo.org/905399
    Signed-off-by: Sam James <[e-mail]>

 dev-libs/libxml2/Manifest              |   2 -
 dev-libs/libxml2/libxml2-2.10.4.ebuild | 203 ---------------------------------
 dev-libs/libxml2/libxml2-2.11.4.ebuild | 202 --------------------------------
 3 files changed, 407 deletions(-)

[Comment 7 Larry the Git Cow 2024-02-09 09:37:30 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=e85e47ba7c520c0a553d527c33c5c297cb8ff286

commit e85e47ba7c520c0a553d527c33c5c297cb8ff286
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-02-09 09:36:36 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-02-09 09:37:22 +0000

    [ GLSA 202402-11 ] libxml2: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/904202
    Bug: https://bugs.gentoo.org/905399
    Bug: https://bugs.gentoo.org/915351
    Bug: https://bugs.gentoo.org/923806
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202402-11.xml | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)