diff --git a/SPECS/libxslt/CVE-2025-7424.patch b/SPECS/libxslt/CVE-2025-7424.patch new file mode 100644 index 00000000000..ad099187c8d --- /dev/null +++ b/SPECS/libxslt/CVE-2025-7424.patch @@ -0,0 +1,103 @@ +From a0c908f1f8970d9f10bbd39888d175a61871690e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Iv=C3=A1n=20Chavero?= +Date: Mon, 24 Nov 2025 01:05:00 -0600 +Subject: [PATCH] Fix Type confusion in xmlNode.psvi between stylesheet and + source nodes + +* libxslt/functions.c: +(xsltDocumentFunctionLoadDocument): +- Implement fix suggested by Ivan Fratric. This copies the xmlDoc, + calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the + xmlDoc to tctxt->docList. +- Add error handling for functions that may return NULL. +* libxslt/transform.c: +- Remove static keyword so this can be called from + xsltDocumentFunctionLoadDocument(). +* libxslt/transformInternals.h: Add. +(xsltCleanupSourceDoc): Add declaration. + +Original author: David Kilzer + +Fixes: #139 CVE-2025-7424 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxslt/commit/f6f7f59998c0642b395ba07e5a30e68866df277d.patch +--- + libxslt/functions.c | 16 +++++++++++++++- + libxslt/transform.c | 3 ++- + libxslt/transformInternals.h | 9 +++++++++ + 3 files changed, 26 insertions(+), 2 deletions(-) + create mode 100644 libxslt/transformInternals.h + +diff --git a/libxslt/functions.c b/libxslt/functions.c +index 72a58dc..11ec039 100644 +--- a/libxslt/functions.c ++++ b/libxslt/functions.c +@@ -34,6 +34,7 @@ + #include "numbersInternals.h" + #include "keys.h" + #include "documents.h" ++#include "transformInternals.h" + + #ifdef WITH_XSLT_DEBUG + #define WITH_XSLT_DEBUG_FUNCTION +@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt, + /* + * This selects the stylesheet's doc itself. + */ +- doc = tctxt->style->doc; ++ doc = xmlCopyDoc(tctxt->style->doc, 1); ++ if (doc == NULL) { ++ xsltTransformError(tctxt, NULL, NULL, ++ "document() : failed to copy style doc\n"); ++ goto out_fragment; ++ } ++ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */ ++ idoc = xsltNewDocument(tctxt, doc); ++ if (idoc == NULL) { ++ xsltTransformError(tctxt, NULL, NULL, ++ "document() : failed to create xsltDocument\n"); ++ xmlFreeDoc(doc); ++ goto out_fragment; ++ } + } else { + goto out_fragment; + } +diff --git a/libxslt/transform.c b/libxslt/transform.c +index 54ef821..38c2dce 100644 +--- a/libxslt/transform.c ++++ b/libxslt/transform.c +@@ -43,6 +43,7 @@ + #include "xsltlocale.h" + #include "pattern.h" + #include "transform.h" ++#include "transformInternals.h" + #include "variables.h" + #include "numbersInternals.h" + #include "namespaces.h" +@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt) + * + * Resets source node flags and ids stored in 'psvi' member. + */ +-static void ++void + xsltCleanupSourceDoc(xmlDocPtr doc) { + xmlNodePtr cur = (xmlNodePtr) doc; + void **psviPtr; +diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h +new file mode 100644 +index 0000000..d0f4282 +--- /dev/null ++++ b/libxslt/transformInternals.h +@@ -0,0 +1,9 @@ ++/* ++ * Summary: set of internal interfaces for the XSLT engine transformation part. ++ * ++ * Copy: See Copyright for the status of this software. ++ * ++ * Author: David Kilzer ++ */ ++ ++void xsltCleanupSourceDoc(xmlDocPtr doc); +-- +2.45.4 + diff --git a/SPECS/libxslt/libxslt.spec b/SPECS/libxslt/libxslt.spec index 12a787bd66a..a5d72a42725 100644 --- a/SPECS/libxslt/libxslt.spec +++ b/SPECS/libxslt/libxslt.spec @@ -2,13 +2,14 @@ Summary: Libxslt is the XSLT C library developed for the GNOME project. XSLT is a an XML language to define transformation for XML. Name: libxslt Version: 1.1.43 -Release: 1%{?dist} +Release: 2%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux Group: System Environment/General Libraries URL: http://xmlsoft.org/libxslt/ Source0: https://download.gnome.org/sources/libxslt/%{majminorver}/%{name}-%{version}.tar.xz +Patch0: CVE-2025-7424.patch BuildRequires: libgcrypt-devel BuildRequires: libxml2-devel Requires: libgcrypt @@ -76,6 +77,9 @@ make %{?_smp_mflags} check %changelog +* Thu Nov 27 2025 Azure Linux Security Servicing Account - 1.1.43-2 +- Patch for CVE-2025-7424 + * Tue Mar 18 2025 Sindhu Karri - 1.1.43-1 - Upgrade to version 1.1.43 to fix CVE-2024-55549 and CVE-2025-24855 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 33b2d0abe95..dd2d26c686c 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -225,7 +225,7 @@ libgpg-error-1.48-1.azl3.aarch64.rpm libgcrypt-1.10.3-1.azl3.aarch64.rpm libksba-1.6.4-1.azl3.aarch64.rpm libksba-devel-1.6.4-1.azl3.aarch64.rpm -libxslt-1.1.43-1.azl3.aarch64.rpm +libxslt-1.1.43-2.azl3.aarch64.rpm npth-1.6-4.azl3.aarch64.rpm pinentry-1.2.1-1.azl3.aarch64.rpm gnupg2-2.4.7-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index e34823fd306..b1d72bf3eb2 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -225,7 +225,7 @@ libgpg-error-1.48-1.azl3.x86_64.rpm libgcrypt-1.10.3-1.azl3.x86_64.rpm libksba-1.6.4-1.azl3.x86_64.rpm libksba-devel-1.6.4-1.azl3.x86_64.rpm -libxslt-1.1.43-1.azl3.x86_64.rpm +libxslt-1.1.43-2.azl3.x86_64.rpm npth-1.6-4.azl3.x86_64.rpm pinentry-1.2.1-1.azl3.x86_64.rpm gnupg2-2.4.7-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index ae1e996a7de..85de2910b56 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -245,9 +245,9 @@ libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm libxml2-2.11.5-7.azl3.aarch64.rpm libxml2-debuginfo-2.11.5-7.azl3.aarch64.rpm libxml2-devel-2.11.5-7.azl3.aarch64.rpm -libxslt-1.1.43-1.azl3.aarch64.rpm -libxslt-debuginfo-1.1.43-1.azl3.aarch64.rpm -libxslt-devel-1.1.43-1.azl3.aarch64.rpm +libxslt-1.1.43-2.azl3.aarch64.rpm +libxslt-debuginfo-1.1.43-2.azl3.aarch64.rpm +libxslt-devel-1.1.43-2.azl3.aarch64.rpm lua-5.4.6-1.azl3.aarch64.rpm lua-debuginfo-5.4.6-1.azl3.aarch64.rpm lua-devel-5.4.6-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index ee4d13df226..4991cd0875b 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -253,9 +253,9 @@ libxml2-devel-2.11.5-7.azl3.x86_64.rpm libxcrypt-4.4.36-2.azl3.x86_64.rpm libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm -libxslt-1.1.43-1.azl3.x86_64.rpm -libxslt-debuginfo-1.1.43-1.azl3.x86_64.rpm -libxslt-devel-1.1.43-1.azl3.x86_64.rpm +libxslt-1.1.43-2.azl3.x86_64.rpm +libxslt-debuginfo-1.1.43-2.azl3.x86_64.rpm +libxslt-devel-1.1.43-2.azl3.x86_64.rpm lua-5.4.6-1.azl3.x86_64.rpm lua-debuginfo-5.4.6-1.azl3.x86_64.rpm lua-devel-5.4.6-1.azl3.x86_64.rpm