From nobody Sat May 31 17:31:23 2025 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4b8nGJ3QGCz5xK36; Sat, 31 May 2025 17:31:36 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Received: from mail-il1-x133.google.com (mail-il1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4b8nGJ0YwSz3JDg; Sat, 31 May 2025 17:31:36 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Authentication-Results: mx1.freebsd.org; none Received: by mail-il1-x133.google.com with SMTP id e9e14a558f8ab-3db6ddcef4eso25345525ab.2; Sat, 31 May 2025 10:31:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1748712695; x=1749317495; darn=freebsd.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=s7/0cQuw4hV1tZiAD0TESknj3ciFtrkde7tLtCnXuXc=; b=KXyori1sirc6WrcQYHc9QLefrTfe6DnfEGLSegveVqs8PP3l3OMfB7N3cFm4c+SDci tMMGGfLNCiPFTGnj/Yh0jUEQuK8oa1iTVXFpj+rMw/1JdLcTc4AOwZBUDO7kfCYiu52a JzJw90R+yantglKpkCFvoo+qXI+GYjEF+pFan7zbbP/EIvHy/zm1EGCQPJDELsFKkC6D SV9awiOrFit3QwTHhcYBVSX8wFAOPAoEpXyIuj/F1sOjdb1mlK85B6d+/a4NY8mdhXmZ bR2AAO7hXwhSRFj441ozjk5dMo/G7bO5XqhDy4lk56zj8W1evnLM73WBXLnoKy9Ug03T Nk3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1748712695; x=1749317495; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=s7/0cQuw4hV1tZiAD0TESknj3ciFtrkde7tLtCnXuXc=; b=bYBzVbUyU7pqZOI1pME3uNOkMQpfUQDE0xPuBLa945kNq49GxQB1ddwxrKGQNGgQtl JEodqQ1vLdpcmz5KXOuoITzVadTFyiRUz3h3aJlfLElVrlqHqyW54jFqDIRu1AU19zNA 4B2071ZyNg+8A7zcchGdIGNPnGvy/Dpr1knSzp2x1Vx2+jfVJgmJ5uI3OIQevUCB/yZ7 hdQJpjDG6EEDZCBOMZNAuv2ZmfYueSuO3JvLgGLOXBQ6zbGmmMmSosFRkGBzusSXNLtE x48ICCP8DJa6S2yAMOoaSi21rsHWhzR14Rnl3YZ2Z4jGw6ZY0KZ8zCDPWGbglDkqaAsg V15g== X-Forwarded-Encrypted: i=1; AJvYcCX4tED3Su+7jnEM61lOwVih/v1Bcw9TKYhnOElnACOh8hnkrhFOf5ifbXjHKH+g93N44BFxEQXG1jlIwjixA8j6QRoByLKWBw==@freebsd.org, AJvYcCXcQWdmzekiKaSwqFehja9udMNcnt9mpOCm3+PKNVlFb8fWk+5WNv0Pt3B6Q0VoGcI7s9EOlXGrSHamfgyQLv8bxuAOr2w=@freebsd.org X-Gm-Message-State: AOJu0Yz8KjIVmuQ+oY/huKz29vJSSqdCvXqs5fGJrZ/88+wL+Geo5PCS trPrMSi6CYopc9x6J4NKoM5lDtKDTx1nGGxIrVQJ7IZ87vgGPEKSNZLpR0CsvqmyHV+FbHUtSDl iA6LARplW0iUME3Z6JOHFxQya+PRb5Ol/ahwC X-Gm-Gg: ASbGncvkq71+x6beDhdUusnb0MFn1cNEZvb6jar9+MUG7nJJa8KjPIgdvy+DFODSVdv H1uLkOTS+GATbMmOmTGu/P0SsX3bQz4NmKqkq4hZfbh4P5+9124k2OETP4vC55BMy/pefOS2o1L lGSKsb4s85t1gVbBnDO61rfGu010YdScA= X-Google-Smtp-Source: AGHT+IG5nj4LdNwsyQFexsVpkZUv4BB6FlCEx0cD8K6jI950LkOVN66DJ+CRNFZPTrj68jODrCA0mH8cQ1ORA7o/nZ0= X-Received: by 2002:a05:6e02:1c29:b0:3dd:89d0:3d82 with SMTP id e9e14a558f8ab-3dd99c2875bmr84370335ab.16.1748712694753; Sat, 31 May 2025 10:31:34 -0700 (PDT) List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 References: <202505311718.54VHISqo031288@gitrepo.freebsd.org> In-Reply-To: <202505311718.54VHISqo031288@gitrepo.freebsd.org> From: =?UTF-8?Q?Fernando_Apestegu=C3=ADa?= Date: Sat, 31 May 2025 19:31:23 +0200 X-Gm-Features: AX0GCFs0MCwiJ4joIkmEdXqfBVSt0sL6CDqxj1kNG5QwXZpSoBl9Ao60tlwhjgQ Message-ID: Subject: Re: git: 9a596e5a5345 - main - security/vuxml: Document libxml2 vulnerabilities To: Daniel Engberg Cc: ports-committers@freebsd.org, dev-commits-ports-all@freebsd.org, dev-commits-ports-main@freebsd.org Content-Type: multipart/alternative; boundary="000000000000fc3112063671e60f" X-Rspamd-Queue-Id: 4b8nGJ0YwSz3JDg X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US] --000000000000fc3112063671e60f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, May 31, 2025 at 7:18=E2=80=AFPM Daniel Engberg = wrote: > The branch main has been updated by diizzy: > > URL: > https://cgit.FreeBSD.org/ports/commit/?id=3D9a596e5a5345db82dcf952243faa5= e9d80d2ef1b > > commit 9a596e5a5345db82dcf952243faa5e9d80d2ef1b > Author: Daniel Engberg > AuthorDate: 2025-05-31 17:17:46 +0000 > Commit: Daniel Engberg > CommitDate: 2025-05-31 17:17:49 +0000 > > security/vuxml: Document libxml2 vulnerabilities > > Document CVE-2024-56171, CVE-2025-24928 and CVE-2025-32414 > --- > security/vuxml/vuln/2025.xml | 89 > ++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 89 insertions(+) > > diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml > index 4681d7869854..1cd062837b12 100644 > --- a/security/vuxml/vuln/2025.xml > +++ b/security/vuxml/vuln/2025.xml > @@ -1,3 +1,92 @@ > + > + libxml2 -- Out-of-bounds memory access > + > + > + xmlsoft > ^^^^^^^^^^^^^^^^^^^ What port is xmlsoft? Shouldn't this be libxml2? > + 2.14.2 > + > + > + > + > +

cve@mitre.org reports:

> +
https://gitlab.gnome.org/GNOME/libxml2/-/issues/889"> > +

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, > out-of-bounds > + memory access can occur in the Python API (Python bindings) becau= se > + of an incorrect return value. This occurs in xmlPythonFileRead a= nd > + xmlPythonFileReadRaw because of a difference between bytes and > + characters.

> +
> + > + > + > + CVE-2025-32414 > + https://nvd.nist.gov/vuln/detail/CVE-2025-32414 > + > + > + 2025-04-08 > + 2025-05-31 > + > + > + > + > + libxml2 -- Stack-based Buffer Overflow > + > + > + libxml2 > + 2.13.6 > + > + > + > + > +

cve@mitre.org reports:

> +
https://gitlab.gnome.org/GNOME/libxml2/-/issues/847"> > +

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a > stack-based > + buffer overflow in xmlSnprintfElements in valid.c. To exploit > this, > + DTD validation must occur for an untrusted document or untrusted > + DTD. NOTE: this is similar to CVE-2017-9047.

> +
> + > + > + > + CVE-2025-24928 > + https://nvd.nist.gov/vuln/detail/CVE-2025-24928 > + > + > + 2025-02-18 > + 2025-05-31 > + > + > + > + > + libxml2 -- Use After Free > + > + > + libxml2 > + 2.13.6 > + > + > + > + > +

cve@mitre.org reports:

> +
https://gitlab.gnome.org/GNOME/libxml2/-/issues/828"> > +

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a > use-after-free > + in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in > + xmlschemas.c. To exploit this, a crafted XML document must be > + validated against an XML schema with certain identity constraints= , > + or a crafted XML schema must be used.

> +
> + > + > + > + CVE-2024-56171 > + https://nvd.nist.gov/vuln/detail/CVE-2024-56171 > + > + > + 2025-02-18 > + 2025-05-31 > + > + > + > > chromium -- multiple security fixes > > --000000000000fc3112063671e60f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Sat, May 31,= 2025 at 7:18=E2=80=AFPM Daniel Engberg <diizzy@freebsd.org> wrote:
The branch main has been updated by diizzy:

URL: https://cgi= t.FreeBSD.org/ports/commit/?id=3D9a596e5a5345db82dcf952243faa5e9d80d2ef1b

commit 9a596e5a5345db82dcf952243faa5e9d80d2ef1b
Author:=C2=A0 =C2=A0 =C2=A0Daniel Engberg <diizzy@FreeBSD.org>
AuthorDate: 2025-05-31 17:17:46 +0000
Commit:=C2=A0 =C2=A0 =C2=A0Daniel Engberg <diizzy@FreeBSD.org>
CommitDate: 2025-05-31 17:17:49 +0000

=C2=A0 =C2=A0 security/vuxml: Document libxml2 vulnerabilities

=C2=A0 =C2=A0 Document CVE-2024-56171, CVE-2025-24928 and CVE-2025-32414 ---
=C2=A0security/vuxml/vuln/2025.xml | 89 +++++++++++++++++++++++++++++++++++= +++++++++
=C2=A01 file changed, 89 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 4681d7869854..1cd062837b12 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,92 @@
+=C2=A0 <vuln vid=3D"2926c487-3e53-11f0-95d4-00a098b42aeb">=
+=C2=A0 =C2=A0 <topic>libxml2 -- Out-of-bounds memory access</topi= c>
+=C2=A0 =C2=A0 <affects>
+=C2=A0 =C2=A0 =C2=A0 <package>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<name>xmlsoft</name>

^^^^^^^^^^^^^^^^^^^

What por= t is xmlsoft? Shouldn't this be libxml2?
=C2=A0
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<range><lt>2.14.2</lt></ra= nge>
+=C2=A0 =C2=A0 =C2=A0 </package>
+=C2=A0 =C2=A0 </affects>
+=C2=A0 =C2=A0 <description>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<body xmlns=3D"http://www.w3.org/199= 9/xhtml">
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<p>cve@mitre.org reports:</p>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<blockquote cite=3D"https://gitlab.gnome.org/GNOME/libxml2/-/issues/889"> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<p>In libxml2 before 2.13.8 and 2.= 14.x before 2.14.2, out-of-bounds
+=C2=A0 =C2=A0 =C2=A0 =C2=A0memory access can occur in the Python API (Pyth= on bindings) because
+=C2=A0 =C2=A0 =C2=A0 =C2=A0of an incorrect return value.=C2=A0 This occurs= in xmlPythonFileRead and
+=C2=A0 =C2=A0 =C2=A0 =C2=A0xmlPythonFileReadRaw because of a difference be= tween bytes and
+=C2=A0 =C2=A0 =C2=A0 =C2=A0characters.</p>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</blockquote>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</body>
+=C2=A0 =C2=A0 </description>
+=C2=A0 =C2=A0 <references>
+=C2=A0 =C2=A0 =C2=A0 <cvename>CVE-2025-32414</cvename>
+=C2=A0 =C2=A0 =C2=A0 <url>https://nvd.nist.gov= /vuln/detail/CVE-2025-32414</url>
+=C2=A0 =C2=A0 </references>
+=C2=A0 =C2=A0 <dates>
+=C2=A0 =C2=A0 =C2=A0 <discovery>2025-04-08</discovery>
+=C2=A0 =C2=A0 =C2=A0 <entry>2025-05-31</entry>
+=C2=A0 =C2=A0 </dates>
+=C2=A0 </vuln>
+
+=C2=A0 <vuln vid=3D"fdd02be0-3e50-11f0-95d4-00a098b42aeb">=
+=C2=A0 =C2=A0 <topic>libxml2 -- Stack-based Buffer Overflow</topi= c>
+=C2=A0 =C2=A0 <affects>
+=C2=A0 =C2=A0 =C2=A0 <package>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<name>libxml2</name>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<range><lt>2.13.6</lt></ra= nge>
+=C2=A0 =C2=A0 =C2=A0 </package>
+=C2=A0 =C2=A0 </affects>
+=C2=A0 =C2=A0 <description>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<body xmlns=3D"http://www.w3.org/199= 9/xhtml">
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<p>cve@mitre.org reports:</p>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<blockquote cite=3D"https://gitlab.gnome.org/GNOME/libxml2/-/issues/847"> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<p>libxml2 before 2.12.10 and 2.13= .x before 2.13.6 has a stack-based
+=C2=A0 =C2=A0 =C2=A0 =C2=A0buffer overflow in xmlSnprintfElements in valid= .c.=C2=A0 To exploit this,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0DTD validation must occur for an untrusted docu= ment or untrusted
+=C2=A0 =C2=A0 =C2=A0 =C2=A0DTD.=C2=A0 NOTE: this is similar to CVE-2017-90= 47.</p>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</blockquote>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</body>
+=C2=A0 =C2=A0 </description>
+=C2=A0 =C2=A0 <references>
+=C2=A0 =C2=A0 =C2=A0 <cvename>CVE-2025-24928</cvename>
+=C2=A0 =C2=A0 =C2=A0 <url>https://nvd.nist.gov= /vuln/detail/CVE-2025-24928</url>
+=C2=A0 =C2=A0 </references>
+=C2=A0 =C2=A0 <dates>
+=C2=A0 =C2=A0 =C2=A0 <discovery>2025-02-18</discovery>
+=C2=A0 =C2=A0 =C2=A0 <entry>2025-05-31</entry>
+=C2=A0 =C2=A0 </dates>
+=C2=A0 </vuln>
+
+=C2=A0 <vuln vid=3D"bd2af307-3e50-11f0-95d4-00a098b42aeb">=
+=C2=A0 =C2=A0 <topic>libxml2 -- Use After Free</topic>
+=C2=A0 =C2=A0 <affects>
+=C2=A0 =C2=A0 =C2=A0 <package>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<name>libxml2</name>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<range><lt>2.13.6</lt></ra= nge>
+=C2=A0 =C2=A0 =C2=A0 </package>
+=C2=A0 =C2=A0 </affects>
+=C2=A0 =C2=A0 <description>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<body xmlns=3D"http://www.w3.org/199= 9/xhtml">
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<p>cve@mitre.org reports:</p>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0<blockquote cite=3D"https://gitlab.gnome.org/GNOME/libxml2/-/issues/828"> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<p>libxml2 before 2.12.10 and 2.13= .x before 2.13.6 has a use-after-free
+=C2=A0 =C2=A0 =C2=A0 =C2=A0in xmlSchemaIDCFillNodeTables and xmlSchemaBubb= leIDCNodeTables in
+=C2=A0 =C2=A0 =C2=A0 =C2=A0xmlschemas.c.=C2=A0 To exploit this, a crafted = XML document must be
+=C2=A0 =C2=A0 =C2=A0 =C2=A0validated against an XML schema with certain id= entity constraints,
+=C2=A0 =C2=A0 =C2=A0 =C2=A0or a crafted XML schema must be used.</p>=
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</blockquote>
+=C2=A0 =C2=A0 =C2=A0 =C2=A0</body>
+=C2=A0 =C2=A0 </description>
+=C2=A0 =C2=A0 <references>
+=C2=A0 =C2=A0 =C2=A0 <cvename>CVE-2024-56171</cvename>
+=C2=A0 =C2=A0 =C2=A0 <url>https://nvd.nist.gov= /vuln/detail/CVE-2024-56171</url>
+=C2=A0 =C2=A0 </references>
+=C2=A0 =C2=A0 <dates>
+=C2=A0 =C2=A0 =C2=A0 <discovery>2025-02-18</discovery>
+=C2=A0 =C2=A0 =C2=A0 <entry>2025-05-31</entry>
+=C2=A0 =C2=A0 </dates>
+=C2=A0 </vuln>
+
=C2=A0 =C2=A0<vuln vid=3D"25acd603-3dde-11f0-8cb5-a8a1599412c6"= ;>
=C2=A0 =C2=A0 =C2=A0<topic>chromium -- multiple security fixes</to= pic>
=C2=A0 =C2=A0 =C2=A0<affects>
--000000000000fc3112063671e60f--