libxslt 1.1.34 fixes a security vulnerability discovered by oss-fuzz. The upstream changelog also indicates a few more security-relevant fixes: https://gitlab.gnome.org/GNOME/libxslt/commit/3653123f992db24cec417d12600f4c67388025e3
@maintainer(s), please create an appropriate ebuild
1) CVE-2019-13117 Description: "In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character." Patch: https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1 2) CVE-2019-13118 Description: "In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data." Patch: https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b 3) CVE-2019-18197 Description: "In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed." Patch: https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285
CVE-2019-13118 (https://nvd.nist.gov/vuln/detail/CVE-2019-13118): In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.
Ping
*** Bug 703274 has been marked as a duplicate of this bug. ***
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=239dd8d12a0181dc4a9b162a96deef14aa7889b7 commit 239dd8d12a0181dc4a9b162a96deef14aa7889b7 Author: Sam James <sam@gentoo.org> AuthorDate: 2020-06-27 08:34:22 +0000 Commit: Matt Turner <mattst88@gentoo.org> CommitDate: 2020-07-29 20:55:19 +0000 dev-libs/libxslt: security bump to 1.1.34 Note that we need the new dev-libs/libxml-2.9.10:2 in order for tests to build successfully. Let's require it in general because upstream may have written their code expecting other properties which didn't show up during testing. Bug: https://bugs.gentoo.org/700386 Closes: https://bugs.gentoo.org/703274 Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Matt Turner <mattst88@gentoo.org> dev-libs/libxslt/Manifest | 1 + .../files/libxslt-1.1.34-simplify-python.patch | 239 +++++++++++++++++++++ dev-libs/libxslt/libxslt-1.1.34.ebuild | 125 +++++++++++ 3 files changed, 365 insertions(+)
We'll give it a few days just in case.
I think we're good to go. I'll CC-ARCHES later today if no objections.
Oh, we need to do this in bug 710748 anyway because of the new tigher dependency on libxml2.
We already handled this in the libxml2 GLSA which needed the newer libxslt anyway.
