mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-21 06:48:18 +00:00
Code Issues Projects Releases Wiki Activity

libxml2: mark CVE-2026-86139 fixed

Browse Source 
The fix for CVE-2026-86139 adds a zero-length guard in
xmlURIEscapeStr, as shown in the upstream commit [1].

The libxml2 2.12.10 source already contains the equivalent guard [3],
so no additional patch is required. Mark the CVE as fixed in the
recipe.

[1] https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139
[3] https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700

(From OE-Core rev: 5485bd1b14421f0519fab93c28e03cfe5bba9969)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar authored and Paul Barker committed 2026-10-19 09:03:17 +01:00
1 parent e196eeee34
commit 0a97d1e900
1 file changed
+5
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-core/libxml/libxml2_2.12.10.bb
+5
View File
@@ -46,6 +46,11 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail
# https://gitlab.gnome.org/GNOME/libxml2/-/issues/958
CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided. https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"
# The Scarthgap 2.12.10 source already contains the equivalent zero-length
# guard required for the xmlURIEscapeStr integer-overflow issue.
# https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700
CVE_STATUS[CVE-2026-86139] = "fixed-version: xmlURIEscapeStr returns NULL when xmlStrlen returns zero"
BINCONFIG = "${bindir}/xml2-config"
PACKAGECONFIG ??= "python \