Skip to content

Commit 216df8a

Browse files
v-smalavathuv-smalavathu
authored
[Medium] Patch libxml2 for CVE-2025-32414 and CVE-2025-32415 (#13522)
Signed-off-by: Sreenivasulu Malavathula <[email protected]>
1 parent 6e671f1 commit 216df8a

File tree

7 files changed

+126
-13
lines changed

7 files changed

+126
-13
lines changed

‎SPECS/libxml2/CVE-2025-32414.patch

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From 9b15cc7ba07e5106027a319d39f7ed3aba8f8a1c Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <[email protected]>
3+
Date: Tue, 27 May 2025 18:48:21 -0500
4+
Subject: [PATCH] Address CVE-2025-32414
5+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8d415b8911be26b12b85497f7cc57143b5321787.patch
6+
7+
---
8+
python/libxml.c | 28 ++++++++++++++++++----------
9+
1 file changed, 18 insertions(+), 10 deletions(-)
10+
11+
diff --git a/python/libxml.c b/python/libxml.c
12+
index e071e82..9be43f8 100644
13+
--- a/python/libxml.c
14+
+++ b/python/libxml.c
15+
@@ -287,7 +287,9 @@ xmlPythonFileReadRaw (void * context, char * buffer, int len) {
16+
#endif
17+
file = (PyObject *) context;
18+
if (file == NULL) return(-1);
19+
- ret = PyEval_CallMethod(file, (char *) "read", (char *) "(i)", len);
20+
+ /* When read() returns a string, the length is in characters not bytes, so
21+
+ request at most len / 4 characters to leave space for UTF-8 encoding. */
22+
+ ret = PyObject_CallMethod(file, (char *) "read", (char *) "(i)", len / 4);
23+
if (ret == NULL) {
24+
printf("xmlPythonFileReadRaw: result is NULL\n");
25+
return(-1);
26+
@@ -322,10 +324,12 @@ xmlPythonFileReadRaw (void * context, char * buffer, int len) {
27+
Py_DECREF(ret);
28+
return(-1);
29+
}
30+
- if (lenread > len)
31+
- memcpy(buffer, data, len);
32+
- else
33+
- memcpy(buffer, data, lenread);
34+
+ if (lenread < 0 || lenread > len) {
35+
+ printf("xmlPythonFileReadRaw: invalid lenread\n");
36+
+ Py_DECREF(ret);
37+
+ return(-1);
38+
+ }
39+
+ memcpy(buffer, data, lenread);
40+
Py_DECREF(ret);
41+
return(lenread);
42+
}
43+
@@ -352,7 +356,9 @@ xmlPythonFileRead (void * context, char * buffer, int len) {
44+
#endif
45+
file = (PyObject *) context;
46+
if (file == NULL) return(-1);
47+
- ret = PyEval_CallMethod(file, (char *) "io_read", (char *) "(i)", len);
48+
+ /* When read() returns a string, the length is in characters not bytes, so
49+
+ request at most len / 4 characters to leave space for UTF-8 encoding. */
50+
+ ret = PyObject_CallMethod(file, (char *) "io_read", (char *) "(i)", len / 4);
51+
if (ret == NULL) {
52+
printf("xmlPythonFileRead: result is NULL\n");
53+
return(-1);
54+
@@ -387,10 +393,12 @@ xmlPythonFileRead (void * context, char * buffer, int len) {
55+
Py_DECREF(ret);
56+
return(-1);
57+
}
58+
- if (lenread > len)
59+
- memcpy(buffer, data, len);
60+
- else
61+
- memcpy(buffer, data, lenread);
62+
+ if (lenread < 0 || lenread > len) {
63+
+ printf("xmlPythonFileRead: invalid lenread\n");
64+
+ Py_DECREF(ret);
65+
+ return(-1);
66+
+ }
67+
+ memcpy(buffer, data, lenread);
68+
Py_DECREF(ret);
69+
return(lenread);
70+
}
71+
--
72+
2.45.2
73+

‎SPECS/libxml2/CVE-2025-32415.patch

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
From 6fd5f6af7993ac513dab32e8a00faf3cf72f408b Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <[email protected]>
3+
Date: Mon, 5 May 2025 11:51:10 -0500
4+
Subject: [PATCH] Address CVE-2025-32415
5+
Upstream Patch Reference: https://gitlab.gnome.org/GNOME/libxml2/-/commit/487ee1d8711c6415218b373ef455fcd969d12399
6+
7+
---
8+
xmlschemas.c | 4 ++--
9+
1 file changed, 2 insertions(+), 2 deletions(-)
10+
11+
diff --git a/xmlschemas.c b/xmlschemas.c
12+
index 1045aab..8cae008 100644
13+
--- a/xmlschemas.c
14+
+++ b/xmlschemas.c
15+
@@ -23618,7 +23618,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
16+
j++;
17+
} while (j < nbDupls);
18+
}
19+
- if (nbNodeTable) {
20+
+ if (bind->nbNodes) {
21+
j = 0;
22+
do {
23+
if (nbFields == 1) {
24+
@@ -23669,7 +23669,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt,
25+
26+
next_node_table_entry:
27+
j++;
28+
- } while (j < nbNodeTable);
29+
+ } while (j < bind->nbNodes);
30+
}
31+
/*
32+
* If everything is fine, then add the IDC target-node to
33+
--
34+
2.45.2
35+

‎SPECS/libxml2/libxml2.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Libxml2
22
Name: libxml2
33
Version: 2.10.4
4-
Release: 6%{?dist}
4+
Release: 7%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -15,6 +15,8 @@ Patch3: CVE-2022-49043.patch
1515
Patch4: CVE-2024-56171.patch
1616
Patch5: CVE-2025-24928.patch
1717
Patch6: CVE-2025-27113.patch
18+
Patch7: CVE-2025-32414.patch
19+
Patch8: CVE-2025-32415.patch
1820
BuildRequires: python3-devel
1921
BuildRequires: python3-xml
2022
Provides: %{name}-tools = %{version}-%{release}
@@ -85,6 +87,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
8587
%{_libdir}/cmake/libxml2/libxml2-config.cmake
8688

8789
%changelog
90+
* Mon May 05 2025 Sreeniavsulu Malavathula <[email protected]> - 2.10.4-7
91+
- Patch CVE-2025-32414 and CVE-2025-32415
92+
8893
* Sat Feb 22 2025 Kanishk Bansal <[email protected]> - 2.10.4-6
8994
- Patch CVE-2025-24928, CVE-2025-27113 & CVE-2024-56171
9095

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-6.cm2.aarch64.rpm
194194
curl-devel-8.8.0-6.cm2.aarch64.rpm
195195
curl-libs-8.8.0-6.cm2.aarch64.rpm
196196
createrepo_c-0.17.5-1.cm2.aarch64.rpm
197-
libxml2-2.10.4-6.cm2.aarch64.rpm
198-
libxml2-devel-2.10.4-6.cm2.aarch64.rpm
197+
libxml2-2.10.4-7.cm2.aarch64.rpm
198+
libxml2-devel-2.10.4-7.cm2.aarch64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ curl-8.8.0-6.cm2.x86_64.rpm
194194
curl-devel-8.8.0-6.cm2.x86_64.rpm
195195
curl-libs-8.8.0-6.cm2.x86_64.rpm
196196
createrepo_c-0.17.5-1.cm2.x86_64.rpm
197-
libxml2-2.10.4-6.cm2.x86_64.rpm
198-
libxml2-devel-2.10.4-6.cm2.x86_64.rpm
197+
libxml2-2.10.4-7.cm2.x86_64.rpm
198+
libxml2-devel-2.10.4-7.cm2.x86_64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.aarch64.rpm
209209
libtasn1-devel-4.19.0-2.cm2.aarch64.rpm
210210
libtool-2.4.6-8.cm2.aarch64.rpm
211211
libtool-debuginfo-2.4.6-8.cm2.aarch64.rpm
212-
libxml2-2.10.4-6.cm2.aarch64.rpm
213-
libxml2-debuginfo-2.10.4-6.cm2.aarch64.rpm
214-
libxml2-devel-2.10.4-6.cm2.aarch64.rpm
212+
libxml2-2.10.4-7.cm2.aarch64.rpm
213+
libxml2-debuginfo-2.10.4-7.cm2.aarch64.rpm
214+
libxml2-devel-2.10.4-7.cm2.aarch64.rpm
215215
libxslt-1.1.34-8.cm2.aarch64.rpm
216216
libxslt-debuginfo-1.1.34-8.cm2.aarch64.rpm
217217
libxslt-devel-1.1.34-8.cm2.aarch64.rpm
@@ -521,7 +521,7 @@ python3-gpg-1.16.0-2.cm2.aarch64.rpm
521521
python3-jinja2-3.0.3-7.cm2.noarch.rpm
522522
python3-libcap-ng-0.8.2-2.cm2.aarch64.rpm
523523
python3-libs-3.9.19-13.cm2.aarch64.rpm
524-
python3-libxml2-2.10.4-6.cm2.aarch64.rpm
524+
python3-libxml2-2.10.4-7.cm2.aarch64.rpm
525525
python3-lxml-4.9.1-1.cm2.aarch64.rpm
526526
python3-magic-5.40-3.cm2.noarch.rpm
527527
python3-markupsafe-2.1.0-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -215,9 +215,9 @@ libtasn1-debuginfo-4.19.0-2.cm2.x86_64.rpm
215215
libtasn1-devel-4.19.0-2.cm2.x86_64.rpm
216216
libtool-2.4.6-8.cm2.x86_64.rpm
217217
libtool-debuginfo-2.4.6-8.cm2.x86_64.rpm
218-
libxml2-2.10.4-6.cm2.x86_64.rpm
219-
libxml2-debuginfo-2.10.4-6.cm2.x86_64.rpm
220-
libxml2-devel-2.10.4-6.cm2.x86_64.rpm
218+
libxml2-2.10.4-7.cm2.x86_64.rpm
219+
libxml2-debuginfo-2.10.4-7.cm2.x86_64.rpm
220+
libxml2-devel-2.10.4-7.cm2.x86_64.rpm
221221
libxslt-1.1.34-8.cm2.x86_64.rpm
222222
libxslt-debuginfo-1.1.34-8.cm2.x86_64.rpm
223223
libxslt-devel-1.1.34-8.cm2.x86_64.rpm
@@ -527,7 +527,7 @@ python3-gpg-1.16.0-2.cm2.x86_64.rpm
527527
python3-jinja2-3.0.3-7.cm2.noarch.rpm
528528
python3-libcap-ng-0.8.2-2.cm2.x86_64.rpm
529529
python3-libs-3.9.19-13.cm2.x86_64.rpm
530-
python3-libxml2-2.10.4-6.cm2.x86_64.rpm
530+
python3-libxml2-2.10.4-7.cm2.x86_64.rpm
531531
python3-lxml-4.9.1-1.cm2.x86_64.rpm
532532
python3-magic-5.40-3.cm2.noarch.rpm
533533
python3-markupsafe-2.1.0-1.cm2.x86_64.rpm

0 commit comments

Comments
 (0)