diff --git a/Bugfix-for-CVE-2025-27113.patch b/Bugfix-for-CVE-2025-27113.patch new file mode 100644 index 0000000000000000000000000000000000000000..d628e5a6a27408c1da27dabbe82989323c20f566 --- /dev/null +++ b/Bugfix-for-CVE-2025-27113.patch @@ -0,0 +1,31 @@ +From 6c716d491dd2e67f08066f4dc0619efeb49e43e6 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Thu, 13 Feb 2025 16:48:53 +0100 +Subject: [PATCH] pattern: Fix compilation of explicit child axis + +The child axis is the default axis and should generate XML_OP_ELEM like +the case without an axis. +--- + pattern.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pattern.c b/pattern.c +index 0877fc1a..6fa88f75 100644 +--- a/pattern.c ++++ b/pattern.c +@@ -1035,10 +1035,10 @@ xmlCompileStepPattern(xmlPatParserContextPtr ctxt) { + goto error; + } + } else { +- PUSH(XML_OP_CHILD, token, URL); ++ PUSH(XML_OP_ELEM, token, URL); + } + } else +- PUSH(XML_OP_CHILD, name, NULL); ++ PUSH(XML_OP_ELEM, name, NULL); + return; + } else if (xmlStrEqual(name, (const xmlChar *) "attribute")) { + XML_PAT_FREE_STRING(ctxt, name) +-- +2.39.3 + diff --git a/libxml2.spec b/libxml2.spec index 0135e8ddad0dcfe289aad97b8b9de55496e1fdd9..3f74efbc6efb86883f2fb5064add7a8100a341b3 100644 --- a/libxml2.spec +++ b/libxml2.spec @@ -1,4 +1,4 @@ -%define anolis_release 8 +%define anolis_release 9 Name: libxml2 Version: 2.11.5 Release: %{anolis_release}%{?dist} @@ -35,6 +35,8 @@ Patch6: bugfix-for-cve-2025-32414.patch Patch7: Bugfix-for-CVE-2025-32415.patch #Upstream fix: https://gitlab.gnome.org/GNOME/libxml2/-/commit/5880a9a6bd97c0f9ac8fc4f30110fe023f484746 Patch8: Bugfix-for-CVE-2024-56171.patch +#Upstream fix: https://gitlab.gnome.org/GNOME/libxml2/-/commit/6c716d491dd2e67f08066f4dc0619efeb49e43e6 +Patch9: Bugfix-for-CVE-2025-27113.patch BuildRequires: cmake-rpm-macros BuildRequires: gcc @@ -180,6 +182,9 @@ gzip -9 -c doc/libxml2-api.xml > doc/libxml2-api.xml.gz %doc NEWS README.md %changelog +* Wed May 14 2025 yangjinlin01 - 2.11.5-9 +- Fix CVE-2025-27113 + * Mon May 12 2025 yangjinlin01 - 2.11.5-8 - Fix CVE-2024-56171