diff --git a/libxslt-1.1.39-CVE-2024-55549.patch b/libxslt-1.1.39-CVE-2024-55549.patch new file mode 100644 index 0000000000000000000000000000000000000000..a374105d3d9049ae43adaf2bf3f2404fb0fdb4ee --- /dev/null +++ b/libxslt-1.1.39-CVE-2024-55549.patch @@ -0,0 +1,45 @@ +From 7f24858ae0f26e610a5a9a6f2a216fa6469c52d1 Mon Sep 17 00:00:00 2001 +From: Nick Wellnhofer +Date: Thu, 5 Dec 2024 12:43:19 +0100 +Subject: [PATCH] [CVE-2024-55549] Fix UAF related to excluded namespaces + +Definitions of excluded namespaces could be deleted in +xsltParseTemplateContent. Store excluded namespace URIs in the +stylesheet's dictionary instead of referencing the namespace definition. + +Thanks to Ivan Fratric for the report! + +Fixes #127. +--- + libxslt/xslt.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libxslt/xslt.c b/libxslt/xslt.c +index 39a700b0..9a081cd1 100644 +--- a/libxslt/xslt.c ++++ b/libxslt/xslt.c +@@ -147,10 +147,20 @@ xsltParseContentError(xsltStylesheetPtr style, + * in case of error + */ + static int +-exclPrefixPush(xsltStylesheetPtr style, xmlChar * value) ++exclPrefixPush(xsltStylesheetPtr style, xmlChar * orig) + { ++ xmlChar *value; + int i; + ++ /* ++ * orig can come from a namespace definition on a node which ++ * could be deleted later, for example in xsltParseTemplateContent. ++ * Store the string in stylesheet's dict to avoid use after free. ++ */ ++ value = (xmlChar *) xmlDictLookup(style->dict, orig, -1); ++ if (value == NULL) ++ return(-1); ++ + /* do not push duplicates */ + for (i = 0;i < style->exclPrefixNr;i++) { + if (xmlStrEqual(style->exclPrefixTab[i], value)) +-- +2.49.0 + diff --git a/libxslt.spec b/libxslt.spec index e841a71c1763aed10dbba8535b83c665460482d7..b8f6f752d543db20671fa898d5cca23c6a1351fc 100644 --- a/libxslt.spec +++ b/libxslt.spec @@ -1,4 +1,5 @@ -%define anolis_release 2 +ExclusiveArch: x86_64 aarch64 +%define anolis_release 3 Name: libxslt Summary: Library providing the Gnome XSLT engine Version: 1.1.39 @@ -10,6 +11,8 @@ Source0: https://download.gnome.org/sources/%{name}/1.1/%{name}-%{version Provides: xsltproc = %{version}-%{release} +# https://issues.redhat.com/browse/RHEL-83503 +Patch0000: libxslt-1.1.39-CVE-2024-55549.patch # https://gitlab.gnome.org/GNOME/libxslt/-/commit/c7c7f1f78dd202a053996fcefe57eb994aec8ef2 Patch0001: bugfix-for-cve-2025-24855.patch @@ -119,6 +122,9 @@ rm -vrf %{buildroot}%{_docdir} %{abidir}/libxsltmod.dump %changelog +* Sun Mar 22 2026 wenjie2025 - 1.1.39-3 +- Fix CVE-2024-55549 (RHEL-83503) + * Mon Apr 14 2025 qizengtian - 1.1.37-2 - Fix CVE-2025-24855 @@ -134,4 +140,3 @@ rm -vrf %{buildroot}%{_docdir} * Thu Apr 07 2022 mgb01105731 - 1.1.35-1 - Init from upstream version 1.1.35 -