Skip to content

Commit f99672f

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch libxml2 for CVE-2025-49795 [MEDIUM] (microsoft#14951)
1 parent 0897a52 commit f99672f

File tree

6 files changed

+90
-13
lines changed

6 files changed

+90
-13
lines changed

‎SPECS/libxml2/CVE-2025-49795.patch‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From 09bf88861ecafdc485b6229b6a16db3a353e7045 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Wed, 29 Oct 2025 05:29:50 +0000
4+
Subject: [PATCH] Schematron: Fix null pointer dereference leading to DoS
5+
(CVE-2025-49795)\n\n- Redirect XPath errors in schematron tests and ensure
6+
proper cleanup\n- Handle NULL eval in xmlSchematronFormatReport value-of
7+
processing\n- Add zvon16 schematron test and expected error output\n\nFixes
8+
#932
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
11+
Upstream-reference: AI Backport of https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667.patch
12+
---
13+
result/schematron/zvon16_0.err | 3 +++
14+
schematron.c | 5 +++++
15+
test/schematron/zvon16.sct | 7 +++++++
16+
test/schematron/zvon16_0.xml | 5 +++++
17+
4 files changed, 20 insertions(+)
18+
create mode 100644 result/schematron/zvon16_0.err
19+
create mode 100644 test/schematron/zvon16.sct
20+
create mode 100644 test/schematron/zvon16_0.xml
21+
22+
diff --git a/result/schematron/zvon16_0.err b/result/schematron/zvon16_0.err
23+
new file mode 100644
24+
index 0000000..3d05240
25+
--- /dev/null
26+
+++ b/result/schematron/zvon16_0.err
27+
@@ -0,0 +1,3 @@
28+
+XPath error : Unregistered function
29+
+./test/schematron/zvon16_0.xml:2: element book: schematron error : /library/book line 2: Book
30+
+./test/schematron/zvon16_0.xml fails to validate
31+
diff --git a/schematron.c b/schematron.c
32+
index a1602ab..d10fdb1 100644
33+
--- a/schematron.c
34+
+++ b/schematron.c
35+
@@ -1483,6 +1483,11 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
36+
select = xmlGetNoNsProp(child, BAD_CAST "select");
37+
comp = xmlXPathCtxtCompile(ctxt->xctxt, select);
38+
eval = xmlXPathCompiledEval(comp, ctxt->xctxt);
39+
+ if (eval == NULL) {
40+
+ xmlXPathFreeCompExpr(comp);
41+
+ xmlFree(select);
42+
+ return ret;
43+
+ }
44+
45+
switch (eval->type) {
46+
case XPATH_NODESET: {
47+
diff --git a/test/schematron/zvon16.sct b/test/schematron/zvon16.sct
48+
new file mode 100644
49+
index 0000000..f03848a
50+
--- /dev/null
51+
+++ b/test/schematron/zvon16.sct
52+
@@ -0,0 +1,7 @@
53+
+<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
54+
+ <sch:pattern id="TestPattern">
55+
+ <sch:rule context="book">
56+
+ <sch:report test="not(@available)">Book <sch:value-of select="falae()"/> test</sch:report>
57+
+ </sch:rule>
58+
+ </sch:pattern>
59+
+</sch:schema>
60+
diff --git a/test/schematron/zvon16_0.xml b/test/schematron/zvon16_0.xml
61+
new file mode 100644
62+
index 0000000..551e2d6
63+
--- /dev/null
64+
+++ b/test/schematron/zvon16_0.xml
65+
@@ -0,0 +1,5 @@
66+
+<library>
67+
+ <book title="Test Book" id="bk101">
68+
+ <author>Test Author</author>
69+
+ </book>
70+
+</library>
71+
--
72+
2.45.4
73+

‎SPECS/libxml2/libxml2.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.11.5
4-
Release: 6%{?dist}
4+
Release: 7%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -20,6 +20,7 @@ Patch8: CVE-2025-32415.patch
2020
Patch9: CVE-2025-6021.patch
2121
Patch10: CVE-2025-6170.patch
2222
Patch11: CVE-2025-49794_CVE-2025-49796.patch
23+
Patch12: CVE-2025-49795.patch
2324

2425
BuildRequires: python3-devel
2526
BuildRequires: python3-xml
@@ -91,6 +92,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
9192
%{_libdir}/cmake/libxml2/libxml2-config.cmake
9293

9394
%changelog
95+
* Wed Oct 29 2025 Azure Linux Security Servicing Account <[email protected]> - 2.11.5-7
96+
- Patch for CVE-2025-49795
97+
9498
* Sat Jul 19 2025 Kshitiz Godara <[email protected]> - 2.11.5-6
9599
- Patch CVE-2025-49794 and CVE-2025-49796
96100
- Also added patches for CVE-2025-6021 (PR#14237) and CVE-2025-6170 (PR#14226)

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-4.azl3.aarch64.rpm
203203
curl-devel-8.11.1-4.azl3.aarch64.rpm
204204
curl-libs-8.11.1-4.azl3.aarch64.rpm
205205
createrepo_c-1.0.3-1.azl3.aarch64.rpm
206-
libxml2-2.11.5-6.azl3.aarch64.rpm
207-
libxml2-devel-2.11.5-6.azl3.aarch64.rpm
206+
libxml2-2.11.5-7.azl3.aarch64.rpm
207+
libxml2-devel-2.11.5-7.azl3.aarch64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-4.azl3.x86_64.rpm
203203
curl-devel-8.11.1-4.azl3.x86_64.rpm
204204
curl-libs-8.11.1-4.azl3.x86_64.rpm
205205
createrepo_c-1.0.3-1.azl3.x86_64.rpm
206-
libxml2-2.11.5-6.azl3.x86_64.rpm
207-
libxml2-devel-2.11.5-6.azl3.x86_64.rpm
206+
libxml2-2.11.5-7.azl3.x86_64.rpm
207+
libxml2-devel-2.11.5-7.azl3.x86_64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,9 @@ libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
242242
libxcrypt-4.4.36-2.azl3.aarch64.rpm
243243
libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm
244244
libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
245-
libxml2-2.11.5-6.azl3.aarch64.rpm
246-
libxml2-debuginfo-2.11.5-6.azl3.aarch64.rpm
247-
libxml2-devel-2.11.5-6.azl3.aarch64.rpm
245+
libxml2-2.11.5-7.azl3.aarch64.rpm
246+
libxml2-debuginfo-2.11.5-7.azl3.aarch64.rpm
247+
libxml2-devel-2.11.5-7.azl3.aarch64.rpm
248248
libxslt-1.1.43-1.azl3.aarch64.rpm
249249
libxslt-debuginfo-1.1.43-1.azl3.aarch64.rpm
250250
libxslt-devel-1.1.43-1.azl3.aarch64.rpm
@@ -543,7 +543,7 @@ python3-gpg-1.23.2-2.azl3.aarch64.rpm
543543
python3-jinja2-3.1.2-3.azl3.noarch.rpm
544544
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
545545
python3-libs-3.12.9-5.azl3.aarch64.rpm
546-
python3-libxml2-2.11.5-6.azl3.aarch64.rpm
546+
python3-libxml2-2.11.5-7.azl3.aarch64.rpm
547547
python3-lxml-4.9.3-1.azl3.aarch64.rpm
548548
python3-magic-5.45-1.azl3.noarch.rpm
549549
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,9 @@ libtasn1-debuginfo-4.19.0-2.azl3.x86_64.rpm
247247
libtasn1-devel-4.19.0-2.azl3.x86_64.rpm
248248
libtool-2.4.7-1.azl3.x86_64.rpm
249249
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
250-
libxml2-2.11.5-6.azl3.x86_64.rpm
251-
libxml2-debuginfo-2.11.5-6.azl3.x86_64.rpm
252-
libxml2-devel-2.11.5-6.azl3.x86_64.rpm
250+
libxml2-2.11.5-7.azl3.x86_64.rpm
251+
libxml2-debuginfo-2.11.5-7.azl3.x86_64.rpm
252+
libxml2-devel-2.11.5-7.azl3.x86_64.rpm
253253
libxcrypt-4.4.36-2.azl3.x86_64.rpm
254254
libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm
255255
libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm
@@ -551,7 +551,7 @@ python3-gpg-1.23.2-2.azl3.x86_64.rpm
551551
python3-jinja2-3.1.2-3.azl3.noarch.rpm
552552
python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm
553553
python3-libs-3.12.9-5.azl3.x86_64.rpm
554-
python3-libxml2-2.11.5-6.azl3.x86_64.rpm
554+
python3-libxml2-2.11.5-7.azl3.x86_64.rpm
555555
python3-lxml-4.9.3-1.azl3.x86_64.rpm
556556
python3-magic-5.45-1.azl3.noarch.rpm
557557
python3-markupsafe-2.1.3-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)