From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/1] Libxml2 CVE-2016-4658 and CVE-2016-5131 Date: Fri, 23 Dec 2016 16:24:31 -0500 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42295) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cKXKg-0001rK-K4 for guix-devel@gnu.org; Fri, 23 Dec 2016 16:24:55 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cKXKd-0006bT-2v for guix-devel@gnu.org; Fri, 23 Dec 2016 16:24:54 -0500 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:32927) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cKXKc-0006bK-SU for guix-devel@gnu.org; Fri, 23 Dec 2016 16:24:51 -0500 Received: from localhost.localdomain (c-76-110-75-179.hsd1.fl.comcast.net [76.110.75.179]) by mail.messagingengine.com (Postfix) with ESMTPA id 319AE7E2B0 for ; Fri, 23 Dec 2016 16:24:48 -0500 (EST) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org This patch fixes CVE-2016-4658 and CVE-2016-5131 in libxml2. I noticed that Debian applied several more upstream changes to their package: https://anonscm.debian.org/cgit/debian-xml-sgml/libxml2.git/tree/debian/patches Here is the upstream repository: https://git.gnome.org/browse/libxml2/log/ Your thoughts? Leo Famulari (1): gnu: libxml: Fix CVE-2016-{4658,5131}. gnu/local.mk | 2 + gnu/packages/patches/libxml2-CVE-2016-4658.patch | 257 +++++++++++++++++++++++ gnu/packages/patches/libxml2-CVE-2016-5131.patch | 218 +++++++++++++++++++ gnu/packages/xml.scm | 2 + 4 files changed, 479 insertions(+) create mode 100644 gnu/packages/patches/libxml2-CVE-2016-4658.patch create mode 100644 gnu/packages/patches/libxml2-CVE-2016-5131.patch -- 2.11.0