Skip to content

Commit b2ef53a

Browse files
Patch libxslt for CVE-2025-7424
1 parent ea0ee67 commit b2ef53a

File tree

6 files changed

+116
-9
lines changed

6 files changed

+116
-9
lines changed

SPECS/libxslt/CVE-2025-7424.patch

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
From a0c908f1f8970d9f10bbd39888d175a61871690e Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Iv=C3=A1n=20Chavero?= <[email protected]>
3+
Date: Mon, 24 Nov 2025 01:05:00 -0600
4+
Subject: [PATCH] Fix Type confusion in xmlNode.psvi between stylesheet and
5+
source nodes
6+
7+
* libxslt/functions.c:
8+
(xsltDocumentFunctionLoadDocument):
9+
- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
10+
calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
11+
xmlDoc to tctxt->docList.
12+
- Add error handling for functions that may return NULL.
13+
* libxslt/transform.c:
14+
- Remove static keyword so this can be called from
15+
xsltDocumentFunctionLoadDocument().
16+
* libxslt/transformInternals.h: Add.
17+
(xsltCleanupSourceDoc): Add declaration.
18+
19+
Original author: David Kilzer <[email protected]>
20+
21+
Fixes: #139 CVE-2025-7424
22+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
23+
Upstream-reference: https://github.com/GNOME/libxslt/commit/f6f7f59998c0642b395ba07e5a30e68866df277d.patch
24+
---
25+
libxslt/functions.c | 16 +++++++++++++++-
26+
libxslt/transform.c | 3 ++-
27+
libxslt/transformInternals.h | 9 +++++++++
28+
3 files changed, 26 insertions(+), 2 deletions(-)
29+
create mode 100644 libxslt/transformInternals.h
30+
31+
diff --git a/libxslt/functions.c b/libxslt/functions.c
32+
index 72a58dc..11ec039 100644
33+
--- a/libxslt/functions.c
34+
+++ b/libxslt/functions.c
35+
@@ -34,6 +34,7 @@
36+
#include "numbersInternals.h"
37+
#include "keys.h"
38+
#include "documents.h"
39+
+#include "transformInternals.h"
40+
41+
#ifdef WITH_XSLT_DEBUG
42+
#define WITH_XSLT_DEBUG_FUNCTION
43+
@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt,
44+
/*
45+
* This selects the stylesheet's doc itself.
46+
*/
47+
- doc = tctxt->style->doc;
48+
+ doc = xmlCopyDoc(tctxt->style->doc, 1);
49+
+ if (doc == NULL) {
50+
+ xsltTransformError(tctxt, NULL, NULL,
51+
+ "document() : failed to copy style doc\n");
52+
+ goto out_fragment;
53+
+ }
54+
+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
55+
+ idoc = xsltNewDocument(tctxt, doc);
56+
+ if (idoc == NULL) {
57+
+ xsltTransformError(tctxt, NULL, NULL,
58+
+ "document() : failed to create xsltDocument\n");
59+
+ xmlFreeDoc(doc);
60+
+ goto out_fragment;
61+
+ }
62+
} else {
63+
goto out_fragment;
64+
}
65+
diff --git a/libxslt/transform.c b/libxslt/transform.c
66+
index 54ef821..38c2dce 100644
67+
--- a/libxslt/transform.c
68+
+++ b/libxslt/transform.c
69+
@@ -43,6 +43,7 @@
70+
#include "xsltlocale.h"
71+
#include "pattern.h"
72+
#include "transform.h"
73+
+#include "transformInternals.h"
74+
#include "variables.h"
75+
#include "numbersInternals.h"
76+
#include "namespaces.h"
77+
@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
78+
*
79+
* Resets source node flags and ids stored in 'psvi' member.
80+
*/
81+
-static void
82+
+void
83+
xsltCleanupSourceDoc(xmlDocPtr doc) {
84+
xmlNodePtr cur = (xmlNodePtr) doc;
85+
void **psviPtr;
86+
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
87+
new file mode 100644
88+
index 0000000..d0f4282
89+
--- /dev/null
90+
+++ b/libxslt/transformInternals.h
91+
@@ -0,0 +1,9 @@
92+
+/*
93+
+ * Summary: set of internal interfaces for the XSLT engine transformation part.
94+
+ *
95+
+ * Copy: See Copyright for the status of this software.
96+
+ *
97+
+ * Author: David Kilzer <[email protected]>
98+
+ */
99+
+
100+
+void xsltCleanupSourceDoc(xmlDocPtr doc);
101+
--
102+
2.45.4
103+

SPECS/libxslt/libxslt.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,14 @@
22
Summary: Libxslt is the XSLT C library developed for the GNOME project. XSLT is a an XML language to define transformation for XML.
33
Name: libxslt
44
Version: 1.1.43
5-
Release: 1%{?dist}
5+
Release: 2%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
99
Group: System Environment/General Libraries
1010
URL: http://xmlsoft.org/libxslt/
1111
Source0: https://download.gnome.org/sources/libxslt/%{majminorver}/%{name}-%{version}.tar.xz
12+
Patch0: CVE-2025-7424.patch
1213
BuildRequires: libgcrypt-devel
1314
BuildRequires: libxml2-devel
1415
Requires: libgcrypt
@@ -76,6 +77,9 @@ make %{?_smp_mflags} check
7677

7778

7879
%changelog
80+
* Thu Nov 27 2025 Azure Linux Security Servicing Account <[email protected]> - 1.1.43-2
81+
- Patch for CVE-2025-7424
82+
7983
* Tue Mar 18 2025 Sindhu Karri <[email protected]> - 1.1.43-1
8084
- Upgrade to version 1.1.43 to fix CVE-2024-55549 and CVE-2025-24855
8185

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ libgpg-error-1.48-1.azl3.aarch64.rpm
225225
libgcrypt-1.10.3-1.azl3.aarch64.rpm
226226
libksba-1.6.4-1.azl3.aarch64.rpm
227227
libksba-devel-1.6.4-1.azl3.aarch64.rpm
228-
libxslt-1.1.43-1.azl3.aarch64.rpm
228+
libxslt-1.1.43-2.azl3.aarch64.rpm
229229
npth-1.6-4.azl3.aarch64.rpm
230230
pinentry-1.2.1-1.azl3.aarch64.rpm
231231
gnupg2-2.4.7-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ libgpg-error-1.48-1.azl3.x86_64.rpm
225225
libgcrypt-1.10.3-1.azl3.x86_64.rpm
226226
libksba-1.6.4-1.azl3.x86_64.rpm
227227
libksba-devel-1.6.4-1.azl3.x86_64.rpm
228-
libxslt-1.1.43-1.azl3.x86_64.rpm
228+
libxslt-1.1.43-2.azl3.x86_64.rpm
229229
npth-1.6-4.azl3.x86_64.rpm
230230
pinentry-1.2.1-1.azl3.x86_64.rpm
231231
gnupg2-2.4.7-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -245,9 +245,9 @@ libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
245245
libxml2-2.11.5-7.azl3.aarch64.rpm
246246
libxml2-debuginfo-2.11.5-7.azl3.aarch64.rpm
247247
libxml2-devel-2.11.5-7.azl3.aarch64.rpm
248-
libxslt-1.1.43-1.azl3.aarch64.rpm
249-
libxslt-debuginfo-1.1.43-1.azl3.aarch64.rpm
250-
libxslt-devel-1.1.43-1.azl3.aarch64.rpm
248+
libxslt-1.1.43-2.azl3.aarch64.rpm
249+
libxslt-debuginfo-1.1.43-2.azl3.aarch64.rpm
250+
libxslt-devel-1.1.43-2.azl3.aarch64.rpm
251251
lua-5.4.6-1.azl3.aarch64.rpm
252252
lua-debuginfo-5.4.6-1.azl3.aarch64.rpm
253253
lua-devel-5.4.6-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -253,9 +253,9 @@ libxml2-devel-2.11.5-7.azl3.x86_64.rpm
253253
libxcrypt-4.4.36-2.azl3.x86_64.rpm
254254
libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm
255255
libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm
256-
libxslt-1.1.43-1.azl3.x86_64.rpm
257-
libxslt-debuginfo-1.1.43-1.azl3.x86_64.rpm
258-
libxslt-devel-1.1.43-1.azl3.x86_64.rpm
256+
libxslt-1.1.43-2.azl3.x86_64.rpm
257+
libxslt-debuginfo-1.1.43-2.azl3.x86_64.rpm
258+
libxslt-devel-1.1.43-2.azl3.x86_64.rpm
259259
lua-5.4.6-1.azl3.x86_64.rpm
260260
lua-debuginfo-5.4.6-1.azl3.x86_64.rpm
261261
lua-devel-5.4.6-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)