Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libxml2: 2.9.3 -> 2.9.4 for three CVEs #15697

Closed
wants to merge 1 commit into from
Closed

libxml2: 2.9.3 -> 2.9.4 for three CVEs #15697

wants to merge 1 commit into from

Conversation

grahamc
Copy link
Member

@grahamc grahamc commented May 25, 2016 •
edited
Loading

Motivation for this change
Things done
  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • OS X
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

and many other fixed issues, available at http://www.xmlsoft.org/news.html

Please backport to 16.03 and 15.09.

@grahamc
libxml2: 2.9.3 -> 2.9.4 for three CVEs
d5c0bd8 
 - CVE-2016-4447: libxml2: Heap-based buffer underreads due to xmlParseName
   https://bugzilla.redhat.com/show_bug.cgi?id=1338686

 - CVE-2016-4448 libxml2: Format string vulnerability
   https://bugzilla.redhat.com/show_bug.cgi?id=1338700

 - CVE-2016-4449 libxml2: Inappropriate fetch of entities content
   https://bugzilla.redhat.com/show_bug.cgi?id=1338701

and many other fixed issues, available at http://www.xmlsoft.org/news.html
@mention-bot
Copy link

By analyzing the blame information on this pull request, we identified @jgillich, @vcunat and @edolstra to be potential reviewers

@grahamc
Copy link
Member Author

grahamc commented May 25, 2016

No chance I'll be able to build and test all the depending packages :)

@joachifm joachifm added 1.severity: mass-rebuild This PR causes a large number of packages to rebuild 1.severity: security Issues which raise a security issue, or PRs that fix one and removed 1.severity: mass-rebuild This PR causes a large number of packages to rebuild labels May 25, 2016
@vcunat vcunat added the 1.severity: mass-rebuild This PR causes a large number of packages to rebuild label May 25, 2016
@vcunat vcunat self-assigned this May 25, 2016
vcunat pushed a commit that referenced this pull request May 25, 2016
@grahamc @vcunat
libxml2: 2.9.3 -> 2.9.4 for three CVEs (close #15697)
809aa9c 
 - CVE-2016-4447: libxml2: Heap-based buffer underreads due to xmlParseName
   https://bugzilla.redhat.com/show_bug.cgi?id=1338686

 - CVE-2016-4448 libxml2: Format string vulnerability
   https://bugzilla.redhat.com/show_bug.cgi?id=1338700

 - CVE-2016-4449 libxml2: Inappropriate fetch of entities content
   https://bugzilla.redhat.com/show_bug.cgi?id=1338701

and many other fixed issues, available at http://www.xmlsoft.org/news.html

(cherry picked from commit 772851f)
@grahamc
Copy link
Member Author

grahamc commented May 25, 2016

Thank you, @vcunat!

@vcunat
Copy link
Member

vcunat commented May 25, 2016

Unfortunately, there's a significant "regression" http://hydra.nixos.org/build/36154318/nixlog/1/raw. It might be that just some invalid code was previously accepted; I don't know ATM.

@vcunat
Copy link
Member

vcunat commented May 25, 2016

Hmm, the test error persists even in latest XMLLibXML (2.0124). We might disable the tests, but I'd prefer to first make sure it's not some new bug in libxml.

@vcunat
Copy link
Member

vcunat commented May 25, 2016

It does seem like a regression in libxml2: https://bugzilla.gnome.org/show_bug.cgi?id=766834. That's a bit unfortunate.

@vcunat
Copy link
Member

vcunat commented May 26, 2016

Hmm, I see some of the CVEs were fixed by @peti :-)

@peti
Copy link
Member

peti commented May 26, 2016

@vcunat, occupational hazard. :-)

@edolstra
Copy link
Member

Should 809aa9c be reverted in the meantime? It broke the 16.03 channels.

@vcunat
Copy link
Member

vcunat commented May 26, 2016 •
edited
Loading

Reverting it would bring back security vulnerabilities, so I don't much like that. I was trying to find some public distro backporting (all) the patches, but I could find none yet, and doing it all myself would take quite some time.

@vcunat
Copy link
Member

vcunat commented May 26, 2016

There's also the possibility that the breakage is caused by one of the security commits.

vcunat added a commit that referenced this pull request May 26, 2016
@vcunat
libxml2: fixup validation problems with 2.9.4
3069606 
... by reverting an upstream commit
/cc #15697.

I should make some distro pay me for digging into such things :-)
vcunat added a commit that referenced this pull request May 26, 2016
@vcunat
libxml2: fixup validation problems with 2.9.4
1b5e492 
... by reverting an upstream commit
/cc #15697.

I should make some distro pay me for digging into such things :-)

(cherry picked from commit 3069606)
@vcunat
Copy link
Member

vcunat commented May 26, 2016

Tracked down, and rebuilding 16.03-small again is scheduled.

@domenkozar
Copy link
Member

domenkozar commented May 26, 2016 •
edited
Loading

@vcunat thanks, you (with a proper fix) were 5min faster than me :)

@vcunat
Copy link
Member

vcunat commented May 26, 2016 •
edited
Loading

Perhaps I should've written I was bisecting it; I didn't expect anyone reacting that fast.

@grahamc
Copy link
Member Author

grahamc commented May 27, 2016

So is this resolved?

@vcunat
Copy link
Member

vcunat commented May 27, 2016

It should be fine in staging and 16.03. I expect to merge staging to master today, after Hydra progresses a bit with the rebuild. (Github should mark this PR as merged at that point.)

@vcunat vcunat closed this in 772851f May 27, 2016
@grahamc grahamc deleted the libxml2 branch November 27, 2016 16:30
adrianpk added a commit to adrianpk/nixpkgs that referenced this pull request May 31, 2024
@adrianpk
libxml2: 2.9.3 -> 2.9.4 for three CVEs (close NixOS#15697)
5ac8fcd 
 - CVE-2016-4447: libxml2: Heap-based buffer underreads due to xmlParseName
   https://bugzilla.redhat.com/show_bug.cgi?id=1338686

 - CVE-2016-4448 libxml2: Format string vulnerability
   https://bugzilla.redhat.com/show_bug.cgi?id=1338700

 - CVE-2016-4449 libxml2: Inappropriate fetch of entities content
   https://bugzilla.redhat.com/show_bug.cgi?id=1338701

and many other fixed issues, available at http://www.xmlsoft.org/news.html

(cherry picked from commit 772851f)
adrianpk added a commit to adrianpk/nixpkgs that referenced this pull request May 31, 2024
@adrianpk
libxml2: fixup validation problems with 2.9.4
ffe764a 
... by reverting an upstream commit
/cc NixOS#15697.

I should make some distro pay me for digging into such things :-)

(cherry picked from commit 3069606)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@vcunat vcunat

Labels
1.severity: mass-rebuild This PR causes a large number of packages to rebuild 1.severity: security Issues which raise a security issue, or PRs that fix one
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@grahamc @mention-bot @vcunat @peti @edolstra @domenkozar @joachifm