Skip to content

Commit ac617ef

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch libxml2 for CVE-2025-49795 [MEDIUM] (microsoft#14953)
1 parent 7576c8b commit ac617ef

File tree

6 files changed

+90
-13
lines changed

6 files changed

+90
-13
lines changed

‎SPECS/libxml2/CVE-2025-49795.patch‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From 66db6085dd4bf883b68871da02a925e1d971763a Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Wed, 29 Oct 2025 05:47:38 +0000
4+
Subject: [PATCH] Schematron: Fix null pointer dereference leading to DoS
5+
(CVE-2025-49795)\n\nFixes #932\n\n- Handle NULL eval in
6+
xmlSchematronFormatReport value-of processing\n- Redirect XPath errors in
7+
schematronTest and restore handler\n- Add regression test zvon16.sct and
8+
zvon16_0.xml\n- Add expected error output result/schematron/zvon16_0.err
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
11+
Upstream-reference: AI Backport of https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667.patch
12+
---
13+
result/schematron/zvon16_0.err | 3 +++
14+
schematron.c | 5 +++++
15+
test/schematron/zvon16.sct | 7 +++++++
16+
test/schematron/zvon16_0.xml | 5 +++++
17+
4 files changed, 20 insertions(+)
18+
create mode 100644 result/schematron/zvon16_0.err
19+
create mode 100644 test/schematron/zvon16.sct
20+
create mode 100644 test/schematron/zvon16_0.xml
21+
22+
diff --git a/result/schematron/zvon16_0.err b/result/schematron/zvon16_0.err
23+
new file mode 100644
24+
index 0000000..3d05240
25+
--- /dev/null
26+
+++ b/result/schematron/zvon16_0.err
27+
@@ -0,0 +1,3 @@
28+
+XPath error : Unregistered function
29+
+./test/schematron/zvon16_0.xml:2: element book: schematron error : /library/book line 2: Book
30+
+./test/schematron/zvon16_0.xml fails to validate
31+
diff --git a/schematron.c b/schematron.c
32+
index 673ef0a..0199e90 100644
33+
--- a/schematron.c
34+
+++ b/schematron.c
35+
@@ -1481,6 +1481,11 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
36+
select = xmlGetNoNsProp(child, BAD_CAST "select");
37+
comp = xmlXPathCtxtCompile(ctxt->xctxt, select);
38+
eval = xmlXPathCompiledEval(comp, ctxt->xctxt);
39+
+ if (eval == NULL) {
40+
+ xmlXPathFreeCompExpr(comp);
41+
+ xmlFree(select);
42+
+ return ret;
43+
+ }
44+
45+
switch (eval->type) {
46+
case XPATH_NODESET: {
47+
diff --git a/test/schematron/zvon16.sct b/test/schematron/zvon16.sct
48+
new file mode 100644
49+
index 0000000..f03848a
50+
--- /dev/null
51+
+++ b/test/schematron/zvon16.sct
52+
@@ -0,0 +1,7 @@
53+
+<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
54+
+ <sch:pattern id="TestPattern">
55+
+ <sch:rule context="book">
56+
+ <sch:report test="not(@available)">Book <sch:value-of select="falae()"/> test</sch:report>
57+
+ </sch:rule>
58+
+ </sch:pattern>
59+
+</sch:schema>
60+
diff --git a/test/schematron/zvon16_0.xml b/test/schematron/zvon16_0.xml
61+
new file mode 100644
62+
index 0000000..551e2d6
63+
--- /dev/null
64+
+++ b/test/schematron/zvon16_0.xml
65+
@@ -0,0 +1,5 @@
66+
+<library>
67+
+ <book title="Test Book" id="bk101">
68+
+ <author>Test Author</author>
69+
+ </book>
70+
+</library>
71+
--
72+
2.45.4
73+

‎SPECS/libxml2/libxml2.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.10.4
4-
Release: 8%{?dist}
4+
Release: 9%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -20,6 +20,7 @@ Patch8: CVE-2025-32415.patch
2020
Patch9: CVE-2025-6170.patch
2121
Patch10: CVE-2025-6021.patch
2222
Patch11: CVE-2025-49794_CVE-2025-49796.patch
23+
Patch12: CVE-2025-49795.patch
2324
BuildRequires: python3-devel
2425
BuildRequires: python3-xml
2526
Provides: %{name}-tools = %{version}-%{release}
@@ -90,6 +91,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
9091
%{_libdir}/cmake/libxml2/libxml2-config.cmake
9192

9293
%changelog
94+
* Wed Oct 29 2025 Azure Linux Security Servicing Account <[email protected]> - 2.10.4-9
95+
- Patch for CVE-2025-49795
96+
9397
* Sun Jul 20 2025 Kshitiz Godara <[email protected]> - 2.10.4-8
9498
- Patch CVE-2025-49794 and CVE-2025-49796
9599
- Also added patches for CVE-2025-6021 (PR#14310) and CVE-2025-6170 (PR#14228)

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-7.cm2.aarch64.rpm
194194
curl-devel-8.8.0-7.cm2.aarch64.rpm
195195
curl-libs-8.8.0-7.cm2.aarch64.rpm
196196
createrepo_c-0.17.5-1.cm2.aarch64.rpm
197-
libxml2-2.10.4-8.cm2.aarch64.rpm
198-
libxml2-devel-2.10.4-8.cm2.aarch64.rpm
197+
libxml2-2.10.4-9.cm2.aarch64.rpm
198+
libxml2-devel-2.10.4-9.cm2.aarch64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-7.cm2.x86_64.rpm
194194
curl-devel-8.8.0-7.cm2.x86_64.rpm
195195
curl-libs-8.8.0-7.cm2.x86_64.rpm
196196
createrepo_c-0.17.5-1.cm2.x86_64.rpm
197-
libxml2-2.10.4-8.cm2.x86_64.rpm
198-
libxml2-devel-2.10.4-8.cm2.x86_64.rpm
197+
libxml2-2.10.4-9.cm2.x86_64.rpm
198+
libxml2-devel-2.10.4-9.cm2.x86_64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.aarch64.rpm
209209
libtasn1-devel-4.19.0-2.cm2.aarch64.rpm
210210
libtool-2.4.6-8.cm2.aarch64.rpm
211211
libtool-debuginfo-2.4.6-8.cm2.aarch64.rpm
212-
libxml2-2.10.4-8.cm2.aarch64.rpm
213-
libxml2-debuginfo-2.10.4-8.cm2.aarch64.rpm
214-
libxml2-devel-2.10.4-8.cm2.aarch64.rpm
212+
libxml2-2.10.4-9.cm2.aarch64.rpm
213+
libxml2-debuginfo-2.10.4-9.cm2.aarch64.rpm
214+
libxml2-devel-2.10.4-9.cm2.aarch64.rpm
215215
libxslt-1.1.34-8.cm2.aarch64.rpm
216216
libxslt-debuginfo-1.1.34-8.cm2.aarch64.rpm
217217
libxslt-devel-1.1.34-8.cm2.aarch64.rpm
@@ -521,7 +521,7 @@ python3-gpg-1.16.0-2.cm2.aarch64.rpm
521521
python3-jinja2-3.0.3-7.cm2.noarch.rpm
522522
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
523523
python3-libs-3.9.19-16.cm2.aarch64.rpm
524-
python3-libxml2-2.10.4-8.cm2.aarch64.rpm
524+
python3-libxml2-2.10.4-9.cm2.aarch64.rpm
525525
python3-lxml-4.9.1-1.cm2.aarch64.rpm
526526
python3-magic-5.40-3.cm2.noarch.rpm
527527
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -215,9 +215,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.x86_64.rpm
215215
libtasn1-devel-4.19.0-2.cm2.x86_64.rpm
216216
libtool-2.4.6-8.cm2.x86_64.rpm
217217
libtool-debuginfo-2.4.6-8.cm2.x86_64.rpm
218-
libxml2-2.10.4-8.cm2.x86_64.rpm
219-
libxml2-debuginfo-2.10.4-8.cm2.x86_64.rpm
220-
libxml2-devel-2.10.4-8.cm2.x86_64.rpm
218+
libxml2-2.10.4-9.cm2.x86_64.rpm
219+
libxml2-debuginfo-2.10.4-9.cm2.x86_64.rpm
220+
libxml2-devel-2.10.4-9.cm2.x86_64.rpm
221221
libxslt-1.1.34-8.cm2.x86_64.rpm
222222
libxslt-debuginfo-1.1.34-8.cm2.x86_64.rpm
223223
libxslt-devel-1.1.34-8.cm2.x86_64.rpm
@@ -527,7 +527,7 @@ python3-gpg-1.16.0-2.cm2.x86_64.rpm
527527
python3-jinja2-3.0.3-7.cm2.noarch.rpm
528528
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
529529
python3-libs-3.9.19-16.cm2.x86_64.rpm
530-
python3-libxml2-2.10.4-8.cm2.x86_64.rpm
530+
python3-libxml2-2.10.4-9.cm2.x86_64.rpm
531531
python3-lxml-4.9.1-1.cm2.x86_64.rpm
532532
python3-magic-5.40-3.cm2.noarch.rpm
533533
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)