Skip to content

Commit 0449245

Browse files
CBL-Mariner-Botkgodara912Kshitiz Godarajslobodzian
authored
[AUTO-CHERRYPICK] Patch libxml2 for CVE-2025-49794, CVE-2025-49796[CRITICAL], CVE-2025-6021[MED], CVE-2025-6170[LOW] - branch 3.0-dev (#14390)
Co-authored-by: kgodara912 <[email protected]> Co-authored-by: Kshitiz Godara <[email protected]> Co-authored-by: jslobodzian <[email protected]>
1 parent 4bf1b36 commit 0449245

File tree

8 files changed

+314
-13
lines changed

8 files changed

+314
-13
lines changed

‎SPECS/libxml2/CVE-2025-49794_CVE-2025-49796.patch‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
From 29efbea1666252fe4fb2185808a0a655aaa680bc Mon Sep 17 00:00:00 2001
2+
From: Nick Wellnhofer <[email protected]>
3+
Date: Fri, 4 Jul 2025 14:28:26 +0200
4+
Subject: [PATCH] schematron: Fix memory safety issues in
5+
xmlSchematronReportOutput
6+
7+
Fix use-after-free (CVE-2025-49794) and type confusion (CVE-2025-49796)
8+
in xmlSchematronReportOutput.
9+
10+
Fixes #931.
11+
Fixes #933.
12+
---
13+
result/schematron/cve-2025-49794_0.err | 2 ++
14+
result/schematron/cve-2025-49796_0.err | 2 ++
15+
schematron.c | 49 ++++++++++++++------------
16+
test/schematron/cve-2025-49794.sct | 10 ++++++
17+
test/schematron/cve-2025-49794_0.xml | 6 ++++
18+
test/schematron/cve-2025-49796.sct | 9 +++++
19+
test/schematron/cve-2025-49796_0.xml | 3 ++
20+
7 files changed, 58 insertions(+), 23 deletions(-)
21+
create mode 100644 result/schematron/cve-2025-49794_0.err
22+
create mode 100644 result/schematron/cve-2025-49796_0.err
23+
create mode 100644 test/schematron/cve-2025-49794.sct
24+
create mode 100644 test/schematron/cve-2025-49794_0.xml
25+
create mode 100644 test/schematron/cve-2025-49796.sct
26+
create mode 100644 test/schematron/cve-2025-49796_0.xml
27+
28+
diff --git a/result/schematron/cve-2025-49794_0.err b/result/schematron/cve-2025-49794_0.err
29+
new file mode 100644
30+
index 0000000..5775231
31+
--- /dev/null
32+
+++ b/result/schematron/cve-2025-49794_0.err
33+
@@ -0,0 +1,2 @@
34+
+./test/schematron/cve-2025-49794_0.xml:2: element boo0: schematron error : /librar0/boo0 line 2:
35+
+./test/schematron/cve-2025-49794_0.xml fails to validate
36+
diff --git a/result/schematron/cve-2025-49796_0.err b/result/schematron/cve-2025-49796_0.err
37+
new file mode 100644
38+
index 0000000..bf875ee
39+
--- /dev/null
40+
+++ b/result/schematron/cve-2025-49796_0.err
41+
@@ -0,0 +1,2 @@
42+
+./test/schematron/cve-2025-49796_0.xml:2: element boo0: schematron error : /librar0/boo0 line 2:
43+
+./test/schematron/cve-2025-49796_0.xml fails to validate
44+
diff --git a/schematron.c b/schematron.c
45+
index c105a75..a1602ab 100644
46+
--- a/schematron.c
47+
+++ b/schematron.c
48+
@@ -1388,27 +1388,15 @@ exit:
49+
* *
50+
************************************************************************/
51+
52+
-static xmlNodePtr
53+
+static xmlXPathObjectPtr
54+
xmlSchematronGetNode(xmlSchematronValidCtxtPtr ctxt,
55+
xmlNodePtr cur, const xmlChar *xpath) {
56+
- xmlNodePtr node = NULL;
57+
- xmlXPathObjectPtr ret;
58+
-
59+
if ((ctxt == NULL) || (cur == NULL) || (xpath == NULL))
60+
return(NULL);
61+
62+
ctxt->xctxt->doc = cur->doc;
63+
ctxt->xctxt->node = cur;
64+
- ret = xmlXPathEval(xpath, ctxt->xctxt);
65+
- if (ret == NULL)
66+
- return(NULL);
67+
-
68+
- if ((ret->type == XPATH_NODESET) &&
69+
- (ret->nodesetval != NULL) && (ret->nodesetval->nodeNr > 0))
70+
- node = ret->nodesetval->nodeTab[0];
71+
-
72+
- xmlXPathFreeObject(ret);
73+
- return(node);
74+
+ return(xmlXPathEval(xpath, ctxt->xctxt));
75+
}
76+
77+
/**
78+
@@ -1454,25 +1442,40 @@ xmlSchematronFormatReport(xmlSchematronValidCtxtPtr ctxt,
79+
(child->type == XML_CDATA_SECTION_NODE))
80+
ret = xmlStrcat(ret, child->content);
81+
else if (IS_SCHEMATRON(child, "name")) {
82+
+ xmlXPathObject *obj = NULL;
83+
xmlChar *path;
84+
85+
path = xmlGetNoNsProp(child, BAD_CAST "path");
86+
87+
node = cur;
88+
if (path != NULL) {
89+
- node = xmlSchematronGetNode(ctxt, cur, path);
90+
- if (node == NULL)
91+
- node = cur;
92+
+ obj = xmlSchematronGetNode(ctxt, cur, path);
93+
+ if ((obj != NULL) &&
94+
+ (obj->type == XPATH_NODESET) &&
95+
+ (obj->nodesetval != NULL) &&
96+
+ (obj->nodesetval->nodeNr > 0))
97+
+ node = obj->nodesetval->nodeTab[0];
98+
xmlFree(path);
99+
}
100+
101+
- if ((node->ns == NULL) || (node->ns->prefix == NULL))
102+
- ret = xmlStrcat(ret, node->name);
103+
- else {
104+
- ret = xmlStrcat(ret, node->ns->prefix);
105+
- ret = xmlStrcat(ret, BAD_CAST ":");
106+
- ret = xmlStrcat(ret, node->name);
107+
+ switch (node->type) {
108+
+ case XML_ELEMENT_NODE:
109+
+ case XML_ATTRIBUTE_NODE:
110+
+ if ((node->ns == NULL) || (node->ns->prefix == NULL))
111+
+ ret = xmlStrcat(ret, node->name);
112+
+ else {
113+
+ ret = xmlStrcat(ret, node->ns->prefix);
114+
+ ret = xmlStrcat(ret, BAD_CAST ":");
115+
+ ret = xmlStrcat(ret, node->name);
116+
+ }
117+
+ break;
118+
+
119+
+ /* TODO: handle other node types */
120+
+ default:
121+
+ break;
122+
}
123+
+
124+
+ xmlXPathFreeObject(obj);
125+
} else if (IS_SCHEMATRON(child, "value-of")) {
126+
xmlChar *select;
127+
xmlXPathObjectPtr eval;
128+
diff --git a/test/schematron/cve-2025-49794.sct b/test/schematron/cve-2025-49794.sct
129+
new file mode 100644
130+
index 0000000..7fc9ee3
131+
--- /dev/null
132+
+++ b/test/schematron/cve-2025-49794.sct
133+
@@ -0,0 +1,10 @@
134+
+<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
135+
+ <sch:pattern id="">
136+
+ <sch:rule context="boo0">
137+
+ <sch:report test="not(0)">
138+
+ <sch:name path="&#9;e|namespace::*|e"/>
139+
+ </sch:report>
140+
+ <sch:report test="0"></sch:report>
141+
+ </sch:rule>
142+
+ </sch:pattern>
143+
+</sch:schema>
144+
diff --git a/test/schematron/cve-2025-49794_0.xml b/test/schematron/cve-2025-49794_0.xml
145+
new file mode 100644
146+
index 0000000..debc64b
147+
--- /dev/null
148+
+++ b/test/schematron/cve-2025-49794_0.xml
149+
@@ -0,0 +1,6 @@
150+
+<librar0>
151+
+ <boo0 t="">
152+
+ <author></author>
153+
+ </boo0>
154+
+ <ins></ins>
155+
+</librar0>
156+
diff --git a/test/schematron/cve-2025-49796.sct b/test/schematron/cve-2025-49796.sct
157+
new file mode 100644
158+
index 0000000..e9702d7
159+
--- /dev/null
160+
+++ b/test/schematron/cve-2025-49796.sct
161+
@@ -0,0 +1,9 @@
162+
+<sch:schema xmlns:sch="http://purl.oclc.org/dsdl/schematron">
163+
+ <sch:pattern id="">
164+
+ <sch:rule context="boo0">
165+
+ <sch:report test="not(0)">
166+
+ <sch:name path="/"/>
167+
+ </sch:report>
168+
+ </sch:rule>
169+
+ </sch:pattern>
170+
+</sch:schema>
171+
diff --git a/test/schematron/cve-2025-49796_0.xml b/test/schematron/cve-2025-49796_0.xml
172+
new file mode 100644
173+
index 0000000..be33c4e
174+
--- /dev/null
175+
+++ b/test/schematron/cve-2025-49796_0.xml
176+
@@ -0,0 +1,3 @@
177+
+<librar0>
178+
+ <boo0/>
179+
+</librar0>
180+
--
181+
2.45.4
182+

‎SPECS/libxml2/CVE-2025-6021.patch‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
From 0bf1ca14616c240c2d87d9ae44c5df810bc2e229 Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <[email protected]>
3+
Date: Wed, 25 Jun 2025 11:22:06 -0500
4+
Subject: [PATCH] Address CVE-2025-6021
5+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/ad346c9a249c4b380bf73c460ad3e81135c5d781
6+
7+
---
8+
tree.c | 12 +++++++++---
9+
1 file changed, 9 insertions(+), 3 deletions(-)
10+
11+
diff --git a/tree.c b/tree.c
12+
index 8910dd8..7172c46 100644
13+
--- a/tree.c
14+
+++ b/tree.c
15+
@@ -49,6 +49,10 @@
16+
#include "private/error.h"
17+
#include "private/tree.h"
18+
19+
+#ifndef SIZE_MAX
20+
+#define SIZE_MAX ((size_t) -1)
21+
+#endif
22+
+
23+
int __xmlRegisterCallbacks = 0;
24+
25+
/************************************************************************
26+
@@ -221,16 +225,18 @@ xmlGetParameterEntityFromDtd(const xmlDtd *dtd, const xmlChar *name) {
27+
xmlChar *
28+
xmlBuildQName(const xmlChar *ncname, const xmlChar *prefix,
29+
xmlChar *memory, int len) {
30+
- int lenn, lenp;
31+
+ size_t lenn, lenp;
32+
xmlChar *ret;
33+
34+
- if (ncname == NULL) return(NULL);
35+
+ if ((ncname == NULL) || (len < 0)) return(NULL);
36+
if (prefix == NULL) return((xmlChar *) ncname);
37+
38+
lenn = strlen((char *) ncname);
39+
lenp = strlen((char *) prefix);
40+
+ if (lenn >= SIZE_MAX - lenp - 1)
41+
+ return(NULL);
42+
43+
- if ((memory == NULL) || (len < lenn + lenp + 2)) {
44+
+ if ((memory == NULL) || ((size_t) len < lenn + lenp + 2)) {
45+
ret = (xmlChar *) xmlMallocAtomic(lenn + lenp + 2);
46+
if (ret == NULL) {
47+
xmlTreeErrMemory("building QName");
48+
--
49+
2.45.2
50+

‎SPECS/libxml2/CVE-2025-6170.patch‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
From af4d4fd3e12fc9553b532f66c3717fe5dedfae98 Mon Sep 17 00:00:00 2001
2+
From: BinduSri-6522866 <[email protected]>
3+
Date: Fri, 4 Jul 2025 11:04:50 +0000
4+
Subject: [PATCH] Address CVE-2025-6170
5+
6+
Upstream Patch reference: https://gitlab.gnome.org/GNOME/libxml2/-/issues/941
7+
---
8+
debugXML.c | 15 ++++++++++-----
9+
1 file changed, 10 insertions(+), 5 deletions(-)
10+
11+
diff --git a/debugXML.c b/debugXML.c
12+
index 3bb1930..2d11213 100644
13+
--- a/debugXML.c
14+
+++ b/debugXML.c
15+
@@ -2781,6 +2781,10 @@ xmlShellPwd(xmlShellCtxtPtr ctxt ATTRIBUTE_UNUSED, char *buffer,
16+
return (0);
17+
}
18+
19+
+#define MAX_PROMPT_SIZE 500
20+
+#define MAX_ARG_SIZE 400
21+
+#define MAX_COMMAND_SIZE 100
22+
+
23+
/**
24+
* xmlShell:
25+
* @doc: the initial document
26+
@@ -2796,10 +2800,10 @@ void
27+
xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
28+
FILE * output)
29+
{
30+
- char prompt[500] = "/ > ";
31+
+ char prompt[MAX_PROMPT_SIZE] = "/ > ";
32+
char *cmdline = NULL, *cur;
33+
- char command[100];
34+
- char arg[400];
35+
+ char command[MAX_COMMAND_SIZE];
36+
+ char arg[MAX_ARG_SIZE];
37+
int i;
38+
xmlShellCtxtPtr ctxt;
39+
xmlXPathObjectPtr list;
40+
@@ -2857,7 +2861,8 @@ xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
41+
cur++;
42+
i = 0;
43+
while ((*cur != ' ') && (*cur != '\t') &&
44+
- (*cur != '\n') && (*cur != '\r')) {
45+
+ (*cur != '\n') && (*cur != '\r') &&
46+
+ (i < (MAX_COMMAND_SIZE - 1))) {
47+
if (*cur == 0)
48+
break;
49+
command[i++] = *cur++;
50+
@@ -2872,7 +2877,7 @@ xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input,
51+
while ((*cur == ' ') || (*cur == '\t'))
52+
cur++;
53+
i = 0;
54+
- while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
55+
+ while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
56+
if (*cur == 0)
57+
break;
58+
arg[i++] = *cur++;
59+
--
60+
2.45.3
61+

‎SPECS/libxml2/libxml2.spec‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.11.5
4-
Release: 5%{?dist}
4+
Release: 6%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -17,6 +17,10 @@ Patch5: CVE-2024-25062.patch
1717
Patch6: CVE-2025-27113.patch
1818
Patch7: CVE-2025-32414.patch
1919
Patch8: CVE-2025-32415.patch
20+
Patch9: CVE-2025-6021.patch
21+
Patch10: CVE-2025-6170.patch
22+
Patch11: CVE-2025-49794_CVE-2025-49796.patch
23+
2024
BuildRequires: python3-devel
2125
BuildRequires: python3-xml
2226
Provides: %{name}-tools = %{version}-%{release}
@@ -87,6 +91,10 @@ find %{buildroot} -type f -name "*.la" -delete -print
8791
%{_libdir}/cmake/libxml2/libxml2-config.cmake
8892

8993
%changelog
94+
* Sat Jul 19 2025 Kshitiz Godara <[email protected]> - 2.11.5-6
95+
- Patch CVE-2025-49794 and CVE-2025-49796
96+
- Also added patches for CVE-2025-6021 (PR#14237) and CVE-2025-6170 (PR#14226)
97+
9098
* Mon May 05 2025 Sreeniavsulu Malavathula <[email protected]> - 2.11.5-5
9199
- Patch CVE-2025-32414 and CVE-2025-32415
92100

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-3.azl3.aarch64.rpm
203203
curl-devel-8.11.1-3.azl3.aarch64.rpm
204204
curl-libs-8.11.1-3.azl3.aarch64.rpm
205205
createrepo_c-1.0.3-1.azl3.aarch64.rpm
206-
libxml2-2.11.5-5.azl3.aarch64.rpm
207-
libxml2-devel-2.11.5-5.azl3.aarch64.rpm
206+
libxml2-2.11.5-6.azl3.aarch64.rpm
207+
libxml2-devel-2.11.5-6.azl3.aarch64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ curl-8.11.1-3.azl3.x86_64.rpm
203203
curl-devel-8.11.1-3.azl3.x86_64.rpm
204204
curl-libs-8.11.1-3.azl3.x86_64.rpm
205205
createrepo_c-1.0.3-1.azl3.x86_64.rpm
206-
libxml2-2.11.5-5.azl3.x86_64.rpm
207-
libxml2-devel-2.11.5-5.azl3.x86_64.rpm
206+
libxml2-2.11.5-6.azl3.x86_64.rpm
207+
libxml2-devel-2.11.5-6.azl3.x86_64.rpm
208208
docbook-dtd-xml-4.5-11.azl3.noarch.rpm
209209
docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
210210
libsepol-3.6-2.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -242,9 +242,9 @@ libtool-debuginfo-2.4.7-1.azl3.aarch64.rpm
242242
libxcrypt-4.4.36-2.azl3.aarch64.rpm
243243
libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm
244244
libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm
245-
libxml2-2.11.5-5.azl3.aarch64.rpm
246-
libxml2-debuginfo-2.11.5-5.azl3.aarch64.rpm
247-
libxml2-devel-2.11.5-5.azl3.aarch64.rpm
245+
libxml2-2.11.5-6.azl3.aarch64.rpm
246+
libxml2-debuginfo-2.11.5-6.azl3.aarch64.rpm
247+
libxml2-devel-2.11.5-6.azl3.aarch64.rpm
248248
libxslt-1.1.43-1.azl3.aarch64.rpm
249249
libxslt-debuginfo-1.1.43-1.azl3.aarch64.rpm
250250
libxslt-devel-1.1.43-1.azl3.aarch64.rpm
@@ -543,7 +543,7 @@ python3-gpg-1.23.2-2.azl3.aarch64.rpm
543543
python3-jinja2-3.1.2-3.azl3.noarch.rpm
544544
python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm
545545
python3-libs-3.12.9-3.azl3.aarch64.rpm
546-
python3-libxml2-2.11.5-5.azl3.aarch64.rpm
546+
python3-libxml2-2.11.5-6.azl3.aarch64.rpm
547547
python3-lxml-4.9.3-1.azl3.aarch64.rpm
548548
python3-magic-5.45-1.azl3.noarch.rpm
549549
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,9 @@ libtasn1-debuginfo-4.19.0-2.azl3.x86_64.rpm
247247
libtasn1-devel-4.19.0-2.azl3.x86_64.rpm
248248
libtool-2.4.7-1.azl3.x86_64.rpm
249249
libtool-debuginfo-2.4.7-1.azl3.x86_64.rpm
250-
libxml2-2.11.5-5.azl3.x86_64.rpm
251-
libxml2-debuginfo-2.11.5-5.azl3.x86_64.rpm
252-
libxml2-devel-2.11.5-5.azl3.x86_64.rpm
250+
libxml2-2.11.5-6.azl3.x86_64.rpm
251+
libxml2-debuginfo-2.11.5-6.azl3.x86_64.rpm
252+
libxml2-devel-2.11.5-6.azl3.x86_64.rpm
253253
libxcrypt-4.4.36-2.azl3.x86_64.rpm
254254
libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm
255255
libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm
@@ -551,7 +551,7 @@ python3-gpg-1.23.2-2.azl3.x86_64.rpm
551551
python3-jinja2-3.1.2-3.azl3.noarch.rpm
552552
python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm
553553
python3-libs-3.12.9-3.azl3.x86_64.rpm
554-
python3-libxml2-2.11.5-5.azl3.x86_64.rpm
554+
python3-libxml2-2.11.5-6.azl3.x86_64.rpm
555555
python3-lxml-4.9.3-1.azl3.x86_64.rpm
556556
python3-magic-5.45-1.azl3.noarch.rpm
557557
python3-markupsafe-2.1.3-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)