[OE-core] [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes
akuster808
akuster808 at gmail.com
Mon Dec 21 16:12:06 UTC 2015
On 12/16/2015 01:05 PM, Joshua Lock wrote:
> Hi Armin,
>
> On 05/12/15 19:35, Armin Kuster wrote:
>> Each CVE is an independant patch so they can be easily merged to other
>> distros
>> and/or stable branches.
>
> As others have mentioned elsewhere I think this would be much nicer if
> each patch was added to the SRC_URI in the same commit which introduces
> the patch.
>
> In addition, I believe it would also make sense to have 2 patches for
> the same CVE applied at once?
>
> Ideally this series would be 11 patches, each of which updated SRC_URI
> and added the patch files to fix a single CVE.
>
That make sense to me.
> What do you think?
I will have more free time soon so I can rend the series in a few days.
I am more than happy to take this series and make the
> suggested change (11 commits, each editing SRC_URI) myself before
> requesting my fido-next branch be merged?
- armin
>
> Thanks,
>
> Joshua
>
>> I have included two previous CVE's sent for jethro which can be ignored.
>> I put the CVE's in order as there where fixed upstream.
>>
>> Armin Kuster (15):
>> libxml2: security fix CVE-2015-7941-1
>> libxml2: security fix CVE-2015-7941-2
>> libxml2: security fix CVE-2015-8317
>> libxml2: security fix CVE-2015-7942
>> libxml2: security fix CVE-2015-7942-2
>> libxml2: security fix CVE-2015-8317
>> libxml2: security fix CVE-2015-7498
>> libxml2: security fix CVE-2015-7497
>> libxml2: security fix CVE-2015-7499-1
>> libxml2: security fix CVE-2015-7499-2
>> libxml2: depend fix security issue CVE-2015-7500
>> libxml2: security fix CVE-2015-7500
>> libxml2: security fix CVE-2015-8242
>> libxml2: security fix CVE-2015-5312
>> libxml2: multiple security fixes.
>>
>> meta/recipes-core/libxml/libxml2.inc | 14 +++
>> ...-2015-5312-Another-entity-expansion-issue.patch | 39 ++++++
>> ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch | 40 ++++++
>> ...00-Fix-memory-access-error-due-to-incorre.patch | 131
>> +++++++++++++++++++
>> ...2015-8035-Fix-XZ-compression-support-loop.patch | 38 ++++++
>> ...42-Buffer-overead-with-HTML-parser-in-pus.patch | 49 ++++++++
>> ...n-name-parsing-at-the-end-of-current-inpu.patch | 138
>> +++++++++++++++++++++
>> ...ssing-entities-after-encoding-conversion-.patch | 89 +++++++++++++
>> ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch | 88 +++++++++++++
>> ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch | 43 +++++++
>> ...top-parsing-on-entities-boundaries-errors.patch | 39 ++++++
>> ...leanup-conditional-section-error-handling.patch | 56 +++++++++
>> ...ror-in-previous-Conditional-section-patch.patch | 35 ++++++
>> ...iation-of-overflow-in-Conditional-section.patch | 39 ++++++
>> ...ng-early-on-if-encoding-conversion-failed.patch | 42 +++++++
>> 15 files changed, 880 insertions(+)
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch
>>
>> create mode 100644
>> meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch
>>
>>
>
More information about the Openembedded-core
mailing list