diff --git a/SPECS/libxml2/CVE-2026-86137.patch b/SPECS/libxml2/CVE-2026-86137.patch new file mode 100644 index 00000000000..d19a1cd88ca --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86137.patch @@ -0,0 +1,53 @@ +From 6a33e8e85607b3cd8552fdc5c6a2b843945e87da Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:09:39 +0000 +Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2.patch +--- + xmlregexp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index 5638ddc..e6c9da9 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -53,7 +53,9 @@ + xmlRegexpErrCompile(ctxt, str); + #define NEXT ctxt->cur++ + #define CUR (*(ctxt->cur)) +-#define NXT(index) (ctxt->cur[index]) ++#define NXT(index) \ ++ (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len) \ ++ ? ctxt->cur[index] : 0) + + #define CUR_SCHAR(s, l) xmlStringCurrentChar(NULL, s, &l) + #define NEXTL(l) ctxt->cur += l; +@@ -243,6 +245,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr; + struct _xmlAutomata { + xmlChar *string; + xmlChar *cur; ++ size_t len; + + int error; + int neg; +@@ -715,8 +718,14 @@ xmlRegNewParserCtxt(const xmlChar *string) { + if (ret == NULL) + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); +- if (string != NULL) ++ if (string != NULL) { + ret->string = xmlStrdup(string); ++ ret->len = strlen((const char *) ret->string); ++ if (ret->string == NULL) { ++ xmlFree(ret); ++ return(NULL); ++ } ++ } + ret->cur = ret->string; + ret->neg = 0; + ret->negs = 0; +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86138.patch b/SPECS/libxml2/CVE-2026-86138.patch new file mode 100644 index 00000000000..526bd6df571 --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86138.patch @@ -0,0 +1,52 @@ +From ce5dfc1854ab06a9c645c51b8dc38118117bff85 Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:24 +0200 +Subject: [PATCH] fix: add overflow checks to xmlDictAddQString in dict.c + +xmlDictAddString has overflow guards for pool size calculations, but its +sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1 +addition can overflow unsigned int, and 4 * (overflowed_value) produces +a small allocation, leading to heap buffer overflow when memcpy writes +the prefix and name. + +Add the same SIZE_MAX-based overflow guards and safe size_t cast. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4.patch +--- + dict.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/dict.c b/dict.c +index d7fd1a0..8f3fe49 100644 +--- a/dict.c ++++ b/dict.c +@@ -312,10 +312,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen, + return(NULL); + } + +- if (size == 0) size = 1000; +- else size *= 4; /* exponential growth */ +- if (size < 4 * (namelen + plen + 1)) +- size = 4 * (namelen + plen + 1); /* just in case ! */ ++ if (size == 0) { ++ size = 1000; ++ } else { ++ if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size *= 4; /* exponential growth */ ++ else ++ size = SIZE_MAX - sizeof(xmlDictStrings); ++ } ++ if (size / 4 < namelen + plen + 1) { ++ if ((size_t) namelen + plen + 1 < ++ (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */ ++ else ++ return(NULL); ++ } + pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size); + if (pool == NULL) + return(NULL); +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86140.patch b/SPECS/libxml2/CVE-2026-86140.patch new file mode 100644 index 00000000000..20e3667a08a --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86140.patch @@ -0,0 +1,56 @@ +From 50ed1dfde2961a81ccbeeff108a916aef047e7ba Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:37 +0200 +Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c + +CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat() +writes, but the sibling function xmlSnprintfElements has the identical +unfixed pattern. The strcat(buf, "(") before the while loop and +strcat(buf, ")") after the loop exit have no bounds checks. + +Add remaining-space checks before both strcat calls, with early return +and ellipsis when space is insufficient. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340.patch +--- + valid.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/valid.c b/valid.c +index b0e25ae..e2f611d 100644 +--- a/valid.c ++++ b/valid.c +@@ -5242,7 +5242,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + int len; + + if (node == NULL) return; +- if (glob) strcat(buf, "("); ++ len = strlen(buf); ++ if (glob) { ++ if (size - len < 50) { ++ if ((size - len > 4) && (buf[len - 1] != '.')) ++ strcat(buf, " ..."); ++ return; ++ } ++ strcat(buf, "("); ++ } + cur = node; + while (cur != NULL) { + len = strlen(buf); +@@ -5306,7 +5314,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + } + cur = cur->next; + } +- if (glob) strcat(buf, ")"); ++ if (glob) { ++ len = strlen(buf); ++ if (size - len > 1) ++ strcat(buf, ")"); ++ } + } + + /** +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86142.patch b/SPECS/libxml2/CVE-2026-86142.patch new file mode 100644 index 00000000000..ca3220dfce4 --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86142.patch @@ -0,0 +1,62 @@ +From a78f4e25fa14687e76eb817f7b37b49910b36958 Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:32:43 +0200 +Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58.patch +--- + include/private/xpath.h | 4 ++++ + xpath.c | 2 +- + xpointer.c | 7 +++++++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/include/private/xpath.h b/include/private/xpath.h +index 0e8d752..0a843c6 100644 +--- a/include/private/xpath.h ++++ b/include/private/xpath.h +@@ -4,4 +4,8 @@ + XML_HIDDEN void + xmlInitXPathInternal(void); + ++#ifdef LIBXML_XPATH_ENABLED ++XML_HIDDEN void ++xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra); ++#endif + #endif /* XML_XPATH_H_PRIVATE__ */ +diff --git a/xpath.c b/xpath.c +index 8df7974..2a13d21 100644 +--- a/xpath.c ++++ b/xpath.c +@@ -683,7 +683,7 @@ xmlXPathErrMemory(xmlXPathContextPtr ctxt, const char *extra) + * + * Handle a redefinition of attribute error + */ +-static void ++void + xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra) + { + if (ctxt == NULL) +diff --git a/xpointer.c b/xpointer.c +index d8c18d7..f8dcc7d 100644 +--- a/xpointer.c ++++ b/xpointer.c +@@ -968,6 +968,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { + level = 1; + + len = xmlStrlen(ctxt->cur); ++ /* Overflow in xmlStrlen */ ++ if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) { ++ xmlXPathPErrMemory(ctxt, NULL); ++ xmlFree(name); ++ return; ++ } ++ + len++; + buffer = (xmlChar *) xmlMallocAtomic(len); + if (buffer == NULL) { +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86143.patch b/SPECS/libxml2/CVE-2026-86143.patch new file mode 100644 index 00000000000..94ed463a52d --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86143.patch @@ -0,0 +1,58 @@ +From cc724cfa159923bda65bb5c8ddcd50945ab23366 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:09:34 +0000 +Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35.patch +--- + xmlIO.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/xmlIO.c b/xmlIO.c +index 5cab16f..64621dc 100644 +--- a/xmlIO.c ++++ b/xmlIO.c +@@ -3354,6 +3354,11 @@ xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) { + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } ++ + /* + * second write the stuff to the I/O channel + */ +@@ -3651,15 +3656,25 @@ xmlOutputBufferFlush(xmlOutputBufferPtr out) { + */ + if ((out->conv != NULL) && (out->encoder != NULL) && + (out->writecallback != NULL)) { ++ size_t bufsize = xmlBufUse(out->conv); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->conv), +- xmlBufUse(out->conv)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->conv, ret); + } else if (out->writecallback != NULL) { ++ size_t bufsize = xmlBufUse(out->buffer); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->buffer), +- xmlBufUse(out->buffer)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->buffer, ret); + } +-- +2.45.4 + diff --git a/SPECS/libxml2/CVE-2026-86144.patch b/SPECS/libxml2/CVE-2026-86144.patch new file mode 100644 index 00000000000..5809406e76e --- /dev/null +++ b/SPECS/libxml2/CVE-2026-86144.patch @@ -0,0 +1,64 @@ +From 61f493e4b736754cdcff5e502a9e5661806734e0 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Tue, 8 Sep 2026 04:10:03 +0000 +Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and + xmlXIncludeProcessTree + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61.patch +--- + xinclude.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/xinclude.c b/xinclude.c +index 09c1eef..df254b0 100644 +--- a/xinclude.c ++++ b/xinclude.c +@@ -1721,9 +1721,25 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, + * Load it. + */ + pctxt = xmlNewParserCtxt(); ++ if (pctxt == NULL) { ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); ++ goto error; ++ } ++ ++ xmlCtxtUseOptions(pctxt, ctxt->parseFlags); ++ + inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt); +- if(inputStream == NULL) ++ if (inputStream == NULL) { ++ if (pctxt->lastError.code == XML_ERR_NO_MEMORY) ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); ++ else if ((pctxt->lastError.code != XML_ERR_OK) && ++ (pctxt->lastError.code != XML_IO_ENOENT) && ++ (pctxt->lastError.code != XML_IO_UNKNOWN) && ++ (pctxt->lastError.code != XML_IO_NETWORK_ATTEMPT)) ++ xmlXIncludeErr(ctxt, ref->elem, pctxt->lastError.code, ++ "load error", NULL); + goto error; ++ } + buf = inputStream->buf; + if (buf == NULL) + goto error; +@@ -2438,7 +2454,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { + */ + int + xmlXIncludeProcess(xmlDocPtr doc) { +- return(xmlXIncludeProcessFlags(doc, 0)); ++ return(xmlXIncludeProcessFlags(doc, doc ? doc->parseFlags : 0)); + } + + /** +@@ -2483,7 +2499,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { + */ + int + xmlXIncludeProcessTree(xmlNodePtr tree) { +- return(xmlXIncludeProcessTreeFlags(tree, 0)); ++ return(xmlXIncludeProcessTreeFlags(tree, (tree && tree->doc) ? tree->doc->parseFlags : 0)); + } + + /** +-- +2.45.4 + diff --git a/SPECS/libxml2/libxml2.spec b/SPECS/libxml2/libxml2.spec index bf5b0a818f9..016849fb304 100644 --- a/SPECS/libxml2/libxml2.spec +++ b/SPECS/libxml2/libxml2.spec @@ -1,7 +1,7 @@ Summary: Libxml2 Name: libxml2 Version: 2.11.5 -Release: 10%{?dist} +Release: 11%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -26,6 +26,12 @@ Patch14: CVE-2026-0990.patch Patch15: CVE-2026-0992.patch Patch16: CVE-2025-8732.patch Patch17: CVE-2026-0989.patch +Patch18: CVE-2026-86137.patch +Patch19: CVE-2026-86138.patch +Patch20: CVE-2026-86140.patch +Patch21: CVE-2026-86142.patch +Patch22: CVE-2026-86143.patch +Patch23: CVE-2026-86144.patch BuildRequires: python3-devel BuildRequires: python3-xml @@ -97,6 +103,9 @@ find %{buildroot} -type f -name "*.la" -delete -print %{_libdir}/cmake/libxml2/libxml2-config.cmake %changelog +* Tue Sep 08 2026 Azure Linux Security Servicing Account - 2.11.5-11 +- Patch for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137 + * Tue Mar 17 2026 Vijayender Putta - 2.11.5-10 - Patch for CVE-2026-0989 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 09fe722729c..cbb7444b34a 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -203,8 +203,8 @@ curl-8.11.1-11.azl3.aarch64.rpm curl-devel-8.11.1-11.azl3.aarch64.rpm curl-libs-8.11.1-11.azl3.aarch64.rpm createrepo_c-1.0.3-1.azl3.aarch64.rpm -libxml2-2.11.5-10.azl3.aarch64.rpm -libxml2-devel-2.11.5-10.azl3.aarch64.rpm +libxml2-2.11.5-11.azl3.aarch64.rpm +libxml2-devel-2.11.5-11.azl3.aarch64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 159bbd8a09d..e9239c5f228 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -203,8 +203,8 @@ curl-8.11.1-11.azl3.x86_64.rpm curl-devel-8.11.1-11.azl3.x86_64.rpm curl-libs-8.11.1-11.azl3.x86_64.rpm createrepo_c-1.0.3-1.azl3.x86_64.rpm -libxml2-2.11.5-10.azl3.x86_64.rpm -libxml2-devel-2.11.5-10.azl3.x86_64.rpm +libxml2-2.11.5-11.azl3.x86_64.rpm +libxml2-devel-2.11.5-11.azl3.x86_64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index a6f44bef434..a9f102a59e5 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -242,9 +242,9 @@ libtool-debuginfo-2.4.7-2.azl3.aarch64.rpm libxcrypt-4.4.36-2.azl3.aarch64.rpm libxcrypt-debuginfo-4.4.36-2.azl3.aarch64.rpm libxcrypt-devel-4.4.36-2.azl3.aarch64.rpm -libxml2-2.11.5-10.azl3.aarch64.rpm -libxml2-debuginfo-2.11.5-10.azl3.aarch64.rpm -libxml2-devel-2.11.5-10.azl3.aarch64.rpm +libxml2-2.11.5-11.azl3.aarch64.rpm +libxml2-debuginfo-2.11.5-11.azl3.aarch64.rpm +libxml2-devel-2.11.5-11.azl3.aarch64.rpm libxslt-1.1.43-3.azl3.aarch64.rpm libxslt-debuginfo-1.1.43-3.azl3.aarch64.rpm libxslt-devel-1.1.43-3.azl3.aarch64.rpm @@ -544,7 +544,7 @@ python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm python3-libmount-2.40.2-5.azl3.aarch64.rpm python3-libs-3.12.14-1.azl3.aarch64.rpm -python3-libxml2-2.11.5-10.azl3.aarch64.rpm +python3-libxml2-2.11.5-11.azl3.aarch64.rpm python3-lxml-4.9.3-3.azl3.aarch64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index d39ca5ba99a..530248dd181 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -247,9 +247,9 @@ libtasn1-debuginfo-4.19.0-3.azl3.x86_64.rpm libtasn1-devel-4.19.0-3.azl3.x86_64.rpm libtool-2.4.7-2.azl3.x86_64.rpm libtool-debuginfo-2.4.7-2.azl3.x86_64.rpm -libxml2-2.11.5-10.azl3.x86_64.rpm -libxml2-debuginfo-2.11.5-10.azl3.x86_64.rpm -libxml2-devel-2.11.5-10.azl3.x86_64.rpm +libxml2-2.11.5-11.azl3.x86_64.rpm +libxml2-debuginfo-2.11.5-11.azl3.x86_64.rpm +libxml2-devel-2.11.5-11.azl3.x86_64.rpm libxcrypt-4.4.36-2.azl3.x86_64.rpm libxcrypt-debuginfo-4.4.36-2.azl3.x86_64.rpm libxcrypt-devel-4.4.36-2.azl3.x86_64.rpm @@ -552,7 +552,7 @@ python3-jinja2-3.1.2-3.azl3.noarch.rpm python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm python3-libmount-2.40.2-5.azl3.x86_64.rpm python3-libs-3.12.14-1.azl3.x86_64.rpm -python3-libxml2-2.11.5-10.azl3.x86_64.rpm +python3-libxml2-2.11.5-11.azl3.x86_64.rpm python3-lxml-4.9.3-3.azl3.x86_64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.x86_64.rpm