pkgsrc-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
pkg/60591: textproc/libxml2: update to 2.15.3
>Number: 60591
>Category: pkg
>Synopsis: textproc/libxml2: update to 2.15.3
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: pkg-manager
>State: open
>Class: change-request
>Submitter-Id: net
>Arrival-Date: Fri Aug 14 21:00:01 +0000 2026
>Originator: Showta Ishizaki
>Release: NetBSD 11.0, pkgsrc CVS as of 2026-08-14
>Organization:
>Environment:
System: NetBSD 11.0 i386
Architecture: i386
Machine: i386
>Description:
pkgsrc has libxml2 2.15.1 (textproc/libxml2/Makefile.common rev 1.31,
2026-02-19). Upstream released 2.15.2 on 2026-03-03 and 2.15.3 on
2026-04-15.
2.15.2 addresses five issues that pkg-vulnerabilities currently lists
against every version of the package. Four are named in its NEWS,
under "### Security":
CVE-2026-1757 "Memory leak in xmllint Shell - shell.c"
CVE-2026-0990 "Prevent infinite recursion in
xmlCatalogListXMLResolve"
CVE-2026-0992 "Exponential behavior when handling"
(the NEWS line is cut short upstream)
CVE-2026-0989 "Add RelaxNG include limit"
The fifth, CVE-2025-8732, is not named in NEWS. The entry for it is
catalog: fix stack overflow from self-referencing SGML CATALOG
entries
Debian's tracker names the fix as commit 3425dece in v2.15.2. That
commit adds a MAX_CATAL_DEPTH check to xmlParseSGMLCatalog and
xmlExpandCatalog, plus test/catalogs/recursive.sgml whose entire
contents are "CATALOG recursive.sgml"; both are in the 2.15.3 tarball.
Upstream merged the same change as !337, closing issue 958, which is
the report the CVE cites.
For what it is worth, neither upstream nor Debian thinks much of this
one. The libxml2 maintainer, quoted in the CVE description itself,
says "[t]he issue can only be triggered with untrusted SGML catalogs
and it makes absolutely no sense to use untrusted catalogs", and Debian
marks it unimportant. Narrowing the entry is still worth doing, since
the present one fires on every version.
2.15.3 adds a type confusion fix in xmlParseReference and in
xmlC14NProcessAttrsAxis, a double free in the Python bindings, and
several memory leak fixes.
For background on why the package sat still: upstream declared libxml2
unmaintained in September 2025. That has since changed. The README on
master now reads "This is open-source software written by hobbyists and
maintained by volunteers", releases have resumed, and 2.15.2 and 2.15.3
each list new contributors in their NEWS. The project asks not to be
pressured over CVEs, which is fair, but it is producing releases again
and pkgsrc is four months behind them.
Five pkg-vulnerabilities entries need narrowing at the same time as this
update, and the diff below does that. They currently read
libxml2-[0-9]* denial-of-service .../CVE-2025-8732
libxml2-[0-9]* denial-of-service .../CVE-2026-0989
libxml2-[0-9]* denial-of-service .../CVE-2026-0990
libxml2-[0-9]* denial-of-service .../CVE-2026-0992
libxml2-[0-9]* denial-of-service .../CVE-2026-1757
All five are fixed in 2.15.2 -- four named in its NEWS, the fifth as
set out above -- so they can become
libxml2<2.15.2 ...
Without that, updating the package does not stop pkg_admin audit from
reporting them, because the entries match every version.
A sixth entry for this package is not a narrowing but a commenting-out:
libxml2-[0-9]* use-after-free .../CVE-2025-12863
CVE-2025-12863 has been rejected. NVD carries nothing for it but
"Rejected reason: This CVE was assigned for a libxml2 issue#1012 but
later deemed not valid"; SUSE record the same sentence and mark it
resolved; Debian's tracker has no entry for it at all. Upstream issue
1012 was closed on 2025-11-19 and never carried a security label.
As written it matches every version, so it reports against any libxml2
for something that turned out not to be a vulnerability. The file says
never to remove entries, so the diff comments it out with a "# rejected"
line above, the way the two ansible CVE-2021-353x entries and the
ImageMagick CVE-2021-34183 entry are handled.
>How-To-Repeat:
cd /usr/pkgsrc/textproc/libxml2 && make show-var VARNAME=DISTNAME
-> libxml2-2.15.1
pkg_admin audit reports all six CVEs above against any installed
libxml2, because those pkg-vulnerabilities entries are written as
libxml2-[0-9]* (every version).
>Fix:
The one patch pkgsrc carries for this package, patch-configure, still
applies unchanged against 2.15.3. distinfo regenerated.
textproc/py-libxml2 shares Makefile.common and is updated by the same
change.
Built and packaged on NetBSD 11.0/i386.
Index: textproc/libxml2/Makefile.common
===================================================================
RCS file: /cvsroot/pkgsrc/textproc/libxml2/Makefile.common,v
retrieving revision 1.31
diff -u -r1.31 Makefile.common
--- textproc/libxml2/Makefile.common 19 Feb 2026 15:09:47 -0000 1.31
+++ textproc/libxml2/Makefile.common 13 Aug 2026 22:40:49 -0000
@@ -3,7 +3,7 @@
# used by textproc/libxml2/Makefile
# used by textproc/py-libxml2/Makefile
-DISTNAME= libxml2-2.15.1
+DISTNAME= libxml2-2.15.3
CATEGORIES= textproc
MASTER_SITES= ${MASTER_SITE_GNOME:=sources/libxml2/${PKGVERSION_NOREV:R}/}
EXTRACT_SUFX= .tar.xz
Index: textproc/libxml2/distinfo
===================================================================
RCS file: /cvsroot/pkgsrc/textproc/libxml2/distinfo,v
retrieving revision 1.157
diff -u -r1.157 distinfo
--- textproc/libxml2/distinfo 19 Feb 2026 15:09:47 -0000 1.157
+++ textproc/libxml2/distinfo 13 Aug 2026 22:40:49 -0000
@@ -1,6 +1,6 @@
$NetBSD: distinfo,v 1.157 2026/02/19 15:09:47 wiz Exp $
-BLAKE2s (libxml2-2.15.1.tar.xz) = 07a7d911cd5af651a4d962435158252c611d9c866736f42e4e87364044047f57
-SHA512 (libxml2-2.15.1.tar.xz) = 429c7d0dc3cbcb8de1bf6eb588fb8025fee009c9b25e87c96ecc5de57cc12b558b0ab8141f333d73ca687109335f297c9f9776abbb9da9afc9d8e79041c86b7f
-Size (libxml2-2.15.1.tar.xz) = 2004588 bytes
+BLAKE2s (libxml2-2.15.3.tar.xz) = b770d0d524330ec9bb0c319f751bc4a4f0376aaff51d30bf35a7e28205292f86
+SHA512 (libxml2-2.15.3.tar.xz) = 6f7f1aabd012454553e851bd1ee548fbd14d21c576f2b2ab9eeedab3dfba51392083f74b34f060e9b538baeea212cdb462b8669c214c711771fb9a897fdc1c60
+Size (libxml2-2.15.3.tar.xz) = 3152452 bytes
SHA1 (patch-configure) = 1f94becea5804e89d32b4e600753aa4dc7527045
Index: doc/pkg-vulnerabilities
===================================================================
RCS file: /cvsroot/pkgsrc/doc/pkg-vulnerabilities,v
retrieving revision 1.776
diff -u -r1.776 pkg-vulnerabilities
--- doc/pkg-vulnerabilities 14 Aug 2026 14:49:56 -0000 1.776
+++ doc/pkg-vulnerabilities 14 Aug 2026 20:14:33 -0000
@@ -27355,7 +27355,7 @@
jasper<4.2.6 null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2025-8835
jasper<4.2.7 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-8836
jasper<4.2.8 use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-8837
-libxml2-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-8732
+libxml2<2.15.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-8732
nasm-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-8842
nasm-[0-9]* heap-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-8843
nasm-[0-9]* null-pointer-dereference https://nvd.nist.gov/vuln/detail/CVE-2025-8844
@@ -28884,7 +28884,8 @@
libarchive-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-60753
libmicrohttpd<1.0.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-59777
libmicrohttpd<1.0.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-62689
-libxml2-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-12863
+# rejected
+#libxml2-[0-9]* use-after-free https://nvd.nist.gov/vuln/detail/CVE-2025-12863
magento<20.16.0 cross-site-scripting https://nvd.nist.gov/vuln/detail/CVE-2025-64174
openexr<3.4.3 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-64181
openexr<3.4.3 buffer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-64182
@@ -29383,9 +29384,9 @@
gradle<9.3.0 input-validation https://nvd.nist.gov/vuln/detail/CVE-2026-22865
libsndfile-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2025-56226
libsoup-[0-9]* out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2026-0716
-libxml2-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0989
-libxml2-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0990
-libxml2-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0992
+libxml2<2.15.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0989
+libxml2<2.15.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0990
+libxml2<2.15.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-0992
metabase<56.3 server-side-request-forgery https://nvd.nist.gov/vuln/detail/CVE-2026-22805
mit-krb5<1.22 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-24528
opencolorio<2.5.1 out-of-bounds-read https://nvd.nist.gov/vuln/detail/CVE-2025-15506
@@ -29581,7 +29582,7 @@
libsoup-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2026-1539
libsoup-[0-9]* http-request-smuggling https://nvd.nist.gov/vuln/detail/CVE-2026-1760
libsoup-[0-9]* stack-overflow https://nvd.nist.gov/vuln/detail/CVE-2026-1761
-libxml2-[0-9]* denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-1757
+libxml2<2.15.2 denial-of-service https://nvd.nist.gov/vuln/detail/CVE-2026-1757
mongo-c-driver<2.1.3 integer-overflow https://nvd.nist.gov/vuln/detail/CVE-2025-14911
monit-[0-9]* sensitive-information-disclosure https://nvd.nist.gov/vuln/detail/CVE-2020-36968
monit-[0-9]* privilege-escalation https://nvd.nist.gov/vuln/detail/CVE-2020-36969
Home |
Main Index |
Thread Index |
Old Index