[AutoPR- Security] Patch libxml2 for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137 [HIGH]

SPECS/libxml2/CVE-2026-86137.patch

@@ -0,0 +1,53 @@
+From 6a33e8e85607b3cd8552fdc5c6a2b843945e87da Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 8 Sep 2026 04:09:39 +0000
+Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2.patch
+---
+ xmlregexp.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/xmlregexp.c b/xmlregexp.c
+index 5638ddc..e6c9da9 100644
+--- a/xmlregexp.c
++++ b/xmlregexp.c
+@@ -53,7 +53,9 @@
+     xmlRegexpErrCompile(ctxt, str);
+ #define NEXT ctxt->cur++
+ #define CUR (*(ctxt->cur))
+-#define NXT(index) (ctxt->cur[index])
++#define NXT(index)									\
++    (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len)				\
++      ? ctxt->cur[index] : 0)
+
+ #define CUR_SCHAR(s, l) xmlStringCurrentChar(NULL, s, &l)
+ #define NEXTL(l) ctxt->cur += l;
+@@ -243,6 +245,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr;
+ struct _xmlAutomata {
+     xmlChar *string;
+     xmlChar *cur;
++    size_t len;
+
+     int error;
+     int neg;
+@@ -715,8 +718,14 @@ xmlRegNewParserCtxt(const xmlChar *string) {
+     if (ret == NULL)
+ 	return(NULL);
+     memset(ret, 0, sizeof(xmlRegParserCtxt));
+-    if (string != NULL)
++    if (string != NULL) {
+ 	ret->string = xmlStrdup(string);
++	ret->len = strlen((const char *) ret->string);
++        if (ret->string == NULL) {
++            xmlFree(ret);
++            return(NULL);
++        }
++    }
+     ret->cur = ret->string;
+     ret->neg = 0;
+     ret->negs = 0;
+-- 
+2.45.4
+

SPECS/libxml2/CVE-2026-86138.patch

@@ -0,0 +1,52 @@
+From ce5dfc1854ab06a9c645c51b8dc38118117bff85 Mon Sep 17 00:00:00 2001
+From: mohammadmseet-hue <mohammadmseet@gmail.com>
+Date: Thu, 16 Apr 2026 02:54:24 +0200
+Subject: [PATCH] fix: add overflow checks to xmlDictAddQString in dict.c
+
+xmlDictAddString has overflow guards for pool size calculations, but its
+sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
+addition can overflow unsigned int, and 4 * (overflowed_value) produces
+a small allocation, leading to heap buffer overflow when memcpy writes
+the prefix and name.
+
+Add the same SIZE_MAX-based overflow guards and safe size_t cast.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4.patch
+---
+ dict.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/dict.c b/dict.c
+index d7fd1a0..8f3fe49 100644
+--- a/dict.c
++++ b/dict.c
+@@ -312,10 +312,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen,
+             return(NULL);
+         }
+
+-        if (size == 0) size = 1000;
+-	else size *= 4; /* exponential growth */
+-        if (size < 4 * (namelen + plen + 1))
+-	    size = 4 * (namelen + plen + 1); /* just in case ! */
++        if (size == 0) {
++            size = 1000;
++        } else {
++            if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4)
++                size *= 4; /* exponential growth */
++            else
++                size = SIZE_MAX - sizeof(xmlDictStrings);
++        }
++        if (size / 4 < namelen + plen + 1) {
++            if ((size_t) namelen + plen + 1 <
++                    (SIZE_MAX - sizeof(xmlDictStrings)) / 4)
++                size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */
++            else
++                return(NULL);
++        }
+ 	pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size);
+ 	if (pool == NULL)
+ 	    return(NULL);
+-- 
+2.45.4
+

SPECS/libxml2/CVE-2026-86140.patch

@@ -0,0 +1,56 @@
+From 50ed1dfde2961a81ccbeeff108a916aef047e7ba Mon Sep 17 00:00:00 2001
+From: mohammadmseet-hue <mohammadmseet@gmail.com>
+Date: Thu, 16 Apr 2026 02:54:37 +0200
+Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c
+
+CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
+writes, but the sibling function xmlSnprintfElements has the identical
+unfixed pattern. The strcat(buf, "(") before the while loop and
+strcat(buf, ")") after the loop exit have no bounds checks.
+
+Add remaining-space checks before both strcat calls, with early return
+and ellipsis when space is insufficient.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340.patch
+---
+ valid.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/valid.c b/valid.c
+index b0e25ae..e2f611d 100644
+--- a/valid.c
++++ b/valid.c
+@@ -5242,7 +5242,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
+     int len;
+
+     if (node == NULL) return;
+-    if (glob) strcat(buf, "(");
++    len = strlen(buf);
++    if (glob) {
++        if (size - len < 50) {
++            if ((size - len > 4) && (buf[len - 1] != '.'))
++                strcat(buf, " ...");
++            return;
++        }
++        strcat(buf, "(");
++    }
+     cur = node;
+     while (cur != NULL) {
+ 	len = strlen(buf);
+@@ -5306,7 +5314,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
+ 	}
+ 	cur = cur->next;
+     }
+-    if (glob) strcat(buf, ")");
++    if (glob) {
++        len = strlen(buf);
++        if (size - len > 1)
++            strcat(buf, ")");
++    }
+ }
+
+ /**
+-- 
+2.45.4
+

SPECS/libxml2/CVE-2026-86142.patch

@@ -0,0 +1,62 @@
+From a78f4e25fa14687e76eb817f7b37b49910b36958 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Mon, 4 May 2026 09:32:43 +0200
+Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58.patch
+---
+ include/private/xpath.h | 4 ++++
+ xpath.c                 | 2 +-
+ xpointer.c              | 7 +++++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/include/private/xpath.h b/include/private/xpath.h
+index 0e8d752..0a843c6 100644
+--- a/include/private/xpath.h
++++ b/include/private/xpath.h
+@@ -4,4 +4,8 @@
+ XML_HIDDEN void
+ xmlInitXPathInternal(void);
+
++#ifdef LIBXML_XPATH_ENABLED
++XML_HIDDEN void
++xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra);
++#endif
+ #endif /* XML_XPATH_H_PRIVATE__ */
+diff --git a/xpath.c b/xpath.c
+index 8df7974..2a13d21 100644
+--- a/xpath.c
++++ b/xpath.c
+@@ -683,7 +683,7 @@ xmlXPathErrMemory(xmlXPathContextPtr ctxt, const char *extra)
+  *
+  * Handle a redefinition of attribute error
+  */
+-static void
++void
+ xmlXPathPErrMemory(xmlXPathParserContextPtr ctxt, const char *extra)
+ {
+     if (ctxt == NULL)
+diff --git a/xpointer.c b/xpointer.c
+index d8c18d7..f8dcc7d 100644
+--- a/xpointer.c
++++ b/xpointer.c
+@@ -968,6 +968,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
+     level = 1;
+
+     len = xmlStrlen(ctxt->cur);
++    /* Overflow in xmlStrlen */
++    if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) {
++        xmlXPathPErrMemory(ctxt, NULL);
++        xmlFree(name);
++        return;
++    }
++
+     len++;
+     buffer = (xmlChar *) xmlMallocAtomic(len);
+     if (buffer == NULL) {
+-- 
+2.45.4
+

SPECS/libxml2/CVE-2026-86143.patch

@@ -0,0 +1,58 @@
+From cc724cfa159923bda65bb5c8ddcd50945ab23366 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 8 Sep 2026 04:09:34 +0000
+Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35.patch
+---
+ xmlIO.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/xmlIO.c b/xmlIO.c
+index 5cab16f..64621dc 100644
+--- a/xmlIO.c
++++ b/xmlIO.c
+@@ -3354,6 +3354,11 @@ xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) {
+             if ((nbchars < MINLEN) && (len <= 0))
+                 goto done;
+
++            if (nbchars >= INT_MAX) {
++                out->error = XML_ERR_INTERNAL_ERROR;
++                return(-1);
++            }
++
+ 	    /*
+ 	     * second write the stuff to the I/O channel
+ 	     */
+@@ -3651,15 +3656,25 @@ xmlOutputBufferFlush(xmlOutputBufferPtr out) {
+      */
+     if ((out->conv != NULL) && (out->encoder != NULL) &&
+ 	(out->writecallback != NULL)) {
++        size_t bufsize = xmlBufUse(out->conv);
++        if (bufsize >= INT_MAX) {
++            out->error = XML_ERR_INTERNAL_ERROR;
++            return(-1);
++        }
+ 	ret = out->writecallback(out->context,
+                                  (const char *)xmlBufContent(out->conv),
+-                                 xmlBufUse(out->conv));
++                                 bufsize);
+ 	if (ret >= 0)
+ 	    xmlBufShrink(out->conv, ret);
+     } else if (out->writecallback != NULL) {
++        size_t bufsize = xmlBufUse(out->buffer);
++        if (bufsize >= INT_MAX) {
++            out->error = XML_ERR_INTERNAL_ERROR;
++            return(-1);
++        }
+ 	ret = out->writecallback(out->context,
+                                  (const char *)xmlBufContent(out->buffer),
+-                                 xmlBufUse(out->buffer));
++                                 bufsize);
+ 	if (ret >= 0)
+ 	    xmlBufShrink(out->buffer, ret);
+     }
+-- 
+2.45.4
+

SPECS/libxml2/CVE-2026-86144.patch

@@ -0,0 +1,64 @@
+From 61f493e4b736754cdcff5e502a9e5661806734e0 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 8 Sep 2026 04:10:03 +0000
+Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and
+ xmlXIncludeProcessTree
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61.patch
+---
+ xinclude.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/xinclude.c b/xinclude.c
+index 09c1eef..df254b0 100644
+--- a/xinclude.c
++++ b/xinclude.c
+@@ -1721,9 +1721,25 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url,
+      * Load it.
+      */
+     pctxt = xmlNewParserCtxt();
++    if (pctxt == NULL) {
++        xmlXIncludeErrMemory(ctxt, ref->elem, NULL);
++        goto error;
++    }
++
++    xmlCtxtUseOptions(pctxt, ctxt->parseFlags);
++
+     inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt);
+-    if(inputStream == NULL)
++    if (inputStream == NULL) {
++        if (pctxt->lastError.code == XML_ERR_NO_MEMORY)
++            xmlXIncludeErrMemory(ctxt, ref->elem, NULL);
++        else if ((pctxt->lastError.code != XML_ERR_OK) &&
++                 (pctxt->lastError.code != XML_IO_ENOENT) &&
++                 (pctxt->lastError.code != XML_IO_UNKNOWN) &&
++                 (pctxt->lastError.code != XML_IO_NETWORK_ATTEMPT))
++            xmlXIncludeErr(ctxt, ref->elem, pctxt->lastError.code,
++                           "load error", NULL);
+ 	goto error;
++    }
+     buf = inputStream->buf;
+     if (buf == NULL)
+ 	goto error;
+@@ -2438,7 +2454,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) {
+  */
+ int
+ xmlXIncludeProcess(xmlDocPtr doc) {
+-    return(xmlXIncludeProcessFlags(doc, 0));
++    return(xmlXIncludeProcessFlags(doc, doc ? doc->parseFlags : 0));
+ }
+
+ /**
+@@ -2483,7 +2499,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) {
+  */
+ int
+ xmlXIncludeProcessTree(xmlNodePtr tree) {
+-    return(xmlXIncludeProcessTreeFlags(tree, 0));
++    return(xmlXIncludeProcessTreeFlags(tree, (tree && tree->doc) ? tree->doc->parseFlags : 0));
+ }
+
+ /**
+-- 
+2.45.4
+

SPECS/libxml2/libxml2.spec

@@ -1,7 +1,7 @@
 Summary:        Libxml2
 Name:           libxml2
 Version:        2.11.5
-Release:        10%{?dist}
+Release:        11%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -26,6 +26,12 @@ Patch14:        CVE-2026-0990.patch
 Patch15:        CVE-2026-0992.patch
 Patch16:        CVE-2025-8732.patch
 Patch17:        CVE-2026-0989.patch
+Patch18:        CVE-2026-86137.patch
+Patch19:        CVE-2026-86138.patch
+Patch20:        CVE-2026-86140.patch
+Patch21:        CVE-2026-86142.patch
+Patch22:        CVE-2026-86143.patch
+Patch23:        CVE-2026-86144.patch
 
 BuildRequires:  python3-devel
 BuildRequires:  python3-xml
@@ -97,6 +103,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %{_libdir}/cmake/libxml2/libxml2-config.cmake
 
 %changelog
+* Tue Sep 08 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.11.5-11
+- Patch for CVE-2026-86144, CVE-2026-86143, CVE-2026-86142, CVE-2026-86140, CVE-2026-86138, CVE-2026-86137
+
 * Tue Mar 17 2026 Vijayender Putta <v-vijputta@microsoft.com> - 2.11.5-10
 - Patch for CVE-2026-0989
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -203,8 +203,8 @@ curl-8.11.1-11.azl3.aarch64.rpm
 curl-devel-8.11.1-11.azl3.aarch64.rpm
 curl-libs-8.11.1-11.azl3.aarch64.rpm
 createrepo_c-1.0.3-1.azl3.aarch64.rpm
-libxml2-2.11.5-10.azl3.aarch64.rpm
-libxml2-devel-2.11.5-10.azl3.aarch64.rpm
+libxml2-2.11.5-11.azl3.aarch64.rpm
+libxml2-devel-2.11.5-11.azl3.aarch64.rpm
 docbook-dtd-xml-4.5-11.azl3.noarch.rpm
 docbook-style-xsl-1.79.1-14.azl3.noarch.rpm
 libsepol-3.6-2.azl3.aarch64.rpm