PR/60591 CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/libxml2

["Maya Rashish" <maya%netbsd.org@localhost>]

The following reply was made to PR pkg/60591; it has been noted by GNATS.

From: "Maya Rashish" <maya%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/60591 CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/libxml2
Date: Sun, 16 Aug 2026 21:52:27 +0000

 Module Name:	pkgsrc
 Committed By:	maya
 Date:		Sun Aug 16 21:52:27 UTC 2026
 
 Modified Files:
 	pkgsrc/textproc/libxml2 [pkgsrc-2026Q2]: Makefile.common distinfo
 
 Log Message:
 Pullup ticket #7237 - requested by wiz
 textproc/libxml2: Security fix
 
 Revisions pulled up:
 - textproc/libxml2/Makefile.common                              1.32
 - textproc/libxml2/distinfo                                     1.158
 
 ---
    Module Name:	pkgsrc
    Committed By:	wiz
    Date:		Sat Aug 15 02:24:28 UTC 2026
 
    Modified Files:
    	pkgsrc/textproc/libxml2: Makefile.common distinfo
 
    Log Message:
    libxml2: update to 2.15.3.
 
    From Showta Ishizaki in PR 60591.
 
    v2.15.3: Apr 15 2026
 
    ### Security
 
    - parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
    - entities: copy children in xmlCopyEntity
    - c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
    - python: Do not decref string after adding to the list (double-free / use-after-free)
    - c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
 
    ### Improvements
 
    - schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
    - xmlreader: propagate reader resource loaders to validator parsers
    - python: Make python bindings python2 compatible
    - xmlregexp: Fix escape-sequence character range matching
    - xmlreader: Free input in xmlReaderForFd (memory-leak)
    - xmlstring: Free cur on every error for xmlStrncat (memory-leak)
    - catalog: Free xmlCatalogResolveCache on cleanup (memory leak)
    - Fix nanohttp.c build when --without-output
    - test: fix mismatched signed/unsigned comparison
 
    v2.15.2: Mar 03 2026
 
    ### Security
 
    - CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
    - CVE-2026-0990 fix: Prevent infinite recursion in
      xmlCatalogListXMLResolve
    - CVE-2026-0992 fix: Exponential behavior when handling
    - parser: Fix infinite loop in xmlCtxtParseContent
    - CVE-2025-10911 libxslt related: Ignore next/prev of documents when
      traversing XPath
    - CVE-2026-0989 fix: Add RelaxNG include limit
    - xmlIO: use size_t for buffer size reallocation
    - uri: fix signed integer overflow in xmlBuildRelativeURISafe
    - schematron: fix memory leaks on error paths in xmlSchematronParseRule
    - catalog: fix stack overflow from self-referencing SGML CATALOG entries
 
    ### Improvements
 
    - fuzz: Make fuzzy encoding match more lenient
    - Fix C14N type confusion
    - meson: Fix build with Meson < 1.3
    - xmllint: Use zlib directly
    - xmllint: New option to separate xpath results using null, --xpath0
    - autotools: Make valgrind actually check for leaks
    - meson: Add valgrind test setup
    - Fix xmlOutputBufferGetContent output when encoder is set
    - threads: don't force _WIN32_WINNT to Vista if it's set to a higher value
    - dist: Add generated documentation to the dist as "dist-doc" folder
      to simplify downstream packaging of doc
    - Fix xmlRemoveEntity removing from wrong hash table
    - use duplicating variant in relaxng to mitigate UAF
    - Fix memory leak in xmlTextWriterStartAttributeNS on OOM
    - meson: remove hardcoded buildtype=debug default
    - Fix memory leak of prefix in xmlTextWriterStartElementNS()
    - writer: Add a few extra NULL checks to avoid memory leaks on corrupt
      writer path.
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.31 -r1.31.4.1 pkgsrc/textproc/libxml2/Makefile.common
 cvs rdiff -u -r1.157 -r1.157.4.1 pkgsrc/textproc/libxml2/distinfo
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.