From 74147b68195be545f30eb3aa2bdd2fd6b75683a2 Mon Sep 17 00:00:00 2001 From: fly_fzc <2385803914@qq.com> Date: Tue, 14 Oct 2025 16:07:04 +0800 Subject: [PATCH] fix CVE-2025-11731 --- ...ion-node-ancestor-search-at-document.patch | 36 +++++++++++++++++++ libxslt.spec | 6 +++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-11731-End-function-node-ancestor-search-at-document.patch diff --git a/backport-CVE-2025-11731-End-function-node-ancestor-search-at-document.patch b/backport-CVE-2025-11731-End-function-node-ancestor-search-at-document.patch new file mode 100644 index 0000000..cdd6b5d --- /dev/null +++ b/backport-CVE-2025-11731-End-function-node-ancestor-search-at-document.patch @@ -0,0 +1,36 @@ +From fe508f201efb9ea37bfbe95413b8b28251497de3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Dominik=20R=C3=B6ttsches?= +Date: Wed, 27 Aug 2025 14:28:40 +0300 +Subject: [PATCH] End function node ancestor search at document + +Avoids dereferencing a non-existent ->ns property on an +XML_DOCUMENT_NODE pointer. + +Fixes #151. +--- + libexslt/functions.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/libexslt/functions.c b/libexslt/functions.c +index 8d35a7ae..a54ee70c 100644 +--- a/libexslt/functions.c ++++ b/libexslt/functions.c +@@ -617,8 +617,13 @@ exsltFuncResultComp (xsltStylesheetPtr style, xmlNodePtr inst, + * instanciation of a func:result element. + */ + for (test = inst->parent; test != NULL; test = test->parent) { +- if (IS_XSLT_ELEM(test) && +- IS_XSLT_NAME(test, "stylesheet")) { ++ if (/* Traversal has reached the top-level document without ++ * finding a func:function ancestor. */ ++ (test != NULL && test->type == XML_DOCUMENT_NODE) || ++ /* Traversal reached a stylesheet-namespace node, ++ * and has left the function namespace. */ ++ (IS_XSLT_ELEM(test) && ++ IS_XSLT_NAME(test, "stylesheet"))) { + xsltGenericError(xsltGenericErrorContext, + "func:result element not a descendant " + "of a func:function\n"); +-- +2.33.0 + diff --git a/libxslt.spec b/libxslt.spec index 17249e6..2e15027 100644 --- a/libxslt.spec +++ b/libxslt.spec @@ -1,6 +1,6 @@ Name: libxslt Version: 1.1.34 -Release: 11 +Release: 12 Summary: XSLT Transformation Library License: MIT URL: http://xmlsoft.org/libxslt/ @@ -22,6 +22,7 @@ Patch12: backport-transform-Avoid-null-deref-on-documents-without-root.patch Patch13: backport-CVE-2025-7424.patch Patch14: backport-CVE-2025-9714-Test-recursion-in-EXSLT-dynamic-functions.patch Patch15: backport-CVE-2025-10911.patch +Patch16: backport-CVE-2025-11731-End-function-node-ancestor-search-at-document.patch BuildRequires: gcc make libtool autoconf automake libgcrypt-devel pkgconfig(libxml-2.0) >= 2.6.27 @@ -111,6 +112,9 @@ pushd $RPM_BUILD_ROOT/%{_includedir}/%{name}; touch -m --reference=xslt.h ../../ %doc python/tests/*.xsl %changelog +* Tue Oct 14 2025 fuanan - 1.1.34-12 +- fix CVE-2025-11731 + * Thu Oct 9 2025 fuanan - 1.1.34-11 - fix CVE-2025-10911 -- Gitee