diff --git a/bugfix-for-cve-2025-24855.patch b/bugfix-for-cve-2025-24855.patch deleted file mode 100644 index 4025672c3cc721fd941ce105ed241eb55d2d2607..0000000000000000000000000000000000000000 --- a/bugfix-for-cve-2025-24855.patch +++ /dev/null @@ -1,130 +0,0 @@ -From c7c7f1f78dd202a053996fcefe57eb994aec8ef2 Mon Sep 17 00:00:00 2001 -From: Nick Wellnhofer -Date: Tue, 17 Dec 2024 15:56:21 +0100 -Subject: [PATCH] [CVE-2025-24855] Fix use-after-free of XPath context node - -There are several places where the XPath context node isn't restored -after modifying it, leading to use-after-free errors with nested XPath -evaluations and dynamically allocated context nodes. - -Restore XPath context node in - -- xsltNumberFormatGetValue -- xsltEvalXPathPredicate -- xsltEvalXPathStringNs -- xsltComputeSortResultInternal - -In some places, the transformation context node was saved and restored -which shouldn't be necessary. - -Thanks to Ivan Fratric for the report! - -Fixes #128. ---- - libxslt/numbers.c | 5 +++++ - libxslt/templates.c | 9 ++++++--- - libxslt/xsltutils.c | 4 ++-- - 3 files changed, 13 insertions(+), 5 deletions(-) - -diff --git a/libxslt/numbers.c b/libxslt/numbers.c -index 0e1fa136..741124d1 100644 ---- a/libxslt/numbers.c -+++ b/libxslt/numbers.c -@@ -733,9 +733,12 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context, - int amount = 0; - xmlBufferPtr pattern; - xmlXPathObjectPtr obj; -+ xmlNodePtr oldNode; - - pattern = xmlBufferCreate(); - if (pattern != NULL) { -+ oldNode = context->node; -+ - xmlBufferCCat(pattern, "number("); - xmlBufferCat(pattern, value); - xmlBufferCCat(pattern, ")"); -@@ -748,6 +751,8 @@ xsltNumberFormatGetValue(xmlXPathContextPtr context, - xmlXPathFreeObject(obj); - } - xmlBufferFree(pattern); -+ -+ context->node = oldNode; - } - return amount; - } -diff --git a/libxslt/templates.c b/libxslt/templates.c -index f08b9bda..1c8d96e2 100644 ---- a/libxslt/templates.c -+++ b/libxslt/templates.c -@@ -61,6 +61,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, - int oldNsNr; - xmlNsPtr *oldNamespaces; - xmlNodePtr oldInst; -+ xmlNodePtr oldNode; - int oldProximityPosition, oldContextSize; - - if ((ctxt == NULL) || (ctxt->inst == NULL)) { -@@ -69,6 +70,7 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, - return(0); - } - -+ oldNode = ctxt->xpathCtxt->node; - oldContextSize = ctxt->xpathCtxt->contextSize; - oldProximityPosition = ctxt->xpathCtxt->proximityPosition; - oldNsNr = ctxt->xpathCtxt->nsNr; -@@ -96,8 +98,9 @@ xsltEvalXPathPredicate(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, - ctxt->state = XSLT_STATE_STOPPED; - ret = 0; - } -- ctxt->xpathCtxt->nsNr = oldNsNr; - -+ ctxt->xpathCtxt->node = oldNode; -+ ctxt->xpathCtxt->nsNr = oldNsNr; - ctxt->xpathCtxt->namespaces = oldNamespaces; - ctxt->inst = oldInst; - ctxt->xpathCtxt->contextSize = oldContextSize; -@@ -137,7 +140,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, - } - - oldInst = ctxt->inst; -- oldNode = ctxt->node; -+ oldNode = ctxt->xpathCtxt->node; - oldPos = ctxt->xpathCtxt->proximityPosition; - oldSize = ctxt->xpathCtxt->contextSize; - oldNsNr = ctxt->xpathCtxt->nsNr; -@@ -167,7 +170,7 @@ xsltEvalXPathStringNs(xsltTransformContextPtr ctxt, xmlXPathCompExprPtr comp, - "xsltEvalXPathString: returns %s\n", ret)); - #endif - ctxt->inst = oldInst; -- ctxt->node = oldNode; -+ ctxt->xpathCtxt->node = oldNode; - ctxt->xpathCtxt->contextSize = oldSize; - ctxt->xpathCtxt->proximityPosition = oldPos; - ctxt->xpathCtxt->nsNr = oldNsNr; -diff --git a/libxslt/xsltutils.c b/libxslt/xsltutils.c -index 0e9dc62f..a20da961 100644 ---- a/libxslt/xsltutils.c -+++ b/libxslt/xsltutils.c -@@ -1065,8 +1065,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort, - return(NULL); - } - -- oldNode = ctxt->node; - oldInst = ctxt->inst; -+ oldNode = ctxt->xpathCtxt->node; - oldPos = ctxt->xpathCtxt->proximityPosition; - oldSize = ctxt->xpathCtxt->contextSize; - oldNsNr = ctxt->xpathCtxt->nsNr; -@@ -1137,8 +1137,8 @@ xsltComputeSortResultInternal(xsltTransformContextPtr ctxt, xmlNodePtr sort, - results[i] = NULL; - } - } -- ctxt->node = oldNode; - ctxt->inst = oldInst; -+ ctxt->xpathCtxt->node = oldNode; - ctxt->xpathCtxt->contextSize = oldSize; - ctxt->xpathCtxt->proximityPosition = oldPos; - ctxt->xpathCtxt->nsNr = oldNsNr; --- -GitLab - diff --git a/libxslt-1.1.37.tar.xz b/libxslt-1.1.37.tar.xz deleted file mode 100644 index c4073daee96bd122e293ccca5a2afc717858d35c..0000000000000000000000000000000000000000 Binary files a/libxslt-1.1.37.tar.xz and /dev/null differ diff --git a/libxslt-1.1.43.tar.xz b/libxslt-1.1.43.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..324fcb06c1a09fd349134be6dc91e3901324ef7f Binary files /dev/null and b/libxslt-1.1.43.tar.xz differ diff --git a/libxslt.spec b/libxslt.spec index 55afc66e97a0de35eef214d579ac6dc85c747c09..621aee001b406320e503cd3fc0e2b567851f8944 100644 --- a/libxslt.spec +++ b/libxslt.spec @@ -1,7 +1,7 @@ -%define anolis_release 2 +%define anolis_release 1 Name: libxslt Summary: Library providing the Gnome XSLT engine -Version: 1.1.37 +Version: 1.1.43 Release: %{anolis_release}%{?dist} License: MIT @@ -10,8 +10,6 @@ Source0: https://download.gnome.org/sources/%{name}/1.1/%{name}-%{version Provides: xsltproc = %{version}-%{release} -# https://gitlab.gnome.org/GNOME/libxslt/-/commit/c7c7f1f78dd202a053996fcefe57eb994aec8ef2 -Patch0001: bugfix-for-cve-2025-24855.patch BuildRequires: make BuildRequires: gcc @@ -80,19 +78,16 @@ rm -vrf %{buildroot}%{_docdir} %{_bindir}/xsltproc %{_libdir}/libxslt.so.* %{_libdir}/libexslt.so.* -%{_libdir}/libxslt-plugins/ %{_mandir}/man1/xsltproc.1* %{abidir}/libxslt.dump %{abidir}/libexslt.dump %files doc -%doc AUTHORS NEWS README FEATURES +%doc AUTHORS NEWS README.md FEATURES %files devel %doc doc/libxslt-api.xml -%doc doc/libxslt-refs.xml %doc doc/EXSLT/libexslt-api.xml -%doc doc/EXSLT/libexslt-refs.xml %doc %{_mandir}/man3/libxslt.3* %doc %{_mandir}/man3/libexslt.3* %doc doc/tutorial @@ -102,7 +97,6 @@ rm -vrf %{buildroot}%{_docdir} %{_libdir}/libxslt.so %{_libdir}/libexslt.so %{_libdir}/xsltConf.sh -%{_datadir}/aclocal/libxslt.m4 %{_includedir}/libxslt/ %{_includedir}/libexslt/ %{_libdir}/pkgconfig/libxslt.pc @@ -121,6 +115,9 @@ rm -vrf %{buildroot}%{_docdir} %{abidir}/libxsltmod.dump %changelog +* Thu May 08 2025 wenxin - 1.1.43-1 +- Fix CVE-2024-55549 + * Mon Apr 14 2025 qizengtian - 1.1.37-2 - Fix CVE-2025-24855