From nobody Sat May 31 17:18:28 2025 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4b8mz81wJ5z5xJf8; Sat, 31 May 2025 17:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4b8mz813l4z4Kkm; Sat, 31 May 2025 17:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748711908; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v782gcXR3OseShIhkUOYpJOfkj9MtGHRXqWHVtZqsoM=; b=Kquf+fo1CWS5yjdYIHdHZKa7o/lCDW3dnN0KfHrzSSQurfyvzABlHNyAmLUsAyC8WQhlOQ kG1sm8fer9nNoSIUWmZIbCjKAAJ2kQI1pCl/AD885bcgUJsJysj+FXc9wJqmNp+6uDUy0R z+fW4oUhaCiQd8/CKxD1sGFE/YXbbPct3wTpGN/1NnXfFDREttOs9evNB0jdBEu2lu7Cj6 22HvgnzdaYt1DUZ74uzDgSBpknk+f6h+72zXEzYt6JMdoVhb08uNIuUm5CuYLhkGbCmQRF oG5+UfRK5ag0klwYsHSz9vrPwoAMDuO2HNRMCY3tP0slOxZ1q3pqGT7tbjmABg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1748711908; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=v782gcXR3OseShIhkUOYpJOfkj9MtGHRXqWHVtZqsoM=; b=lJdzVXn1pd/TaQqrEk7J6f+70W1dfEWdeVTrvV3mpIzdiTMeU2MZhxAJygWT0dowNQp4zo 9mYXUpsXijoNss+PUYHEIeAqRPci0LElujchcu6v69r5LAFY+KuFUjsHdyBRfwMFXA2VcG LrPkN4XEwz0RcNaGvrsh+QxV6P5EMgfUoGdyLzAtRZ25rER6XEuxZH/GFEnQ7z6YMzwKm/ 3WpExdxj9wD1DLSUpXvCXkxt2xW0tfL/6F/kOIICllnESv679G/b3rg3Za97N/o6xWj9RE nerl7Btq1zWW4WdoRwuGvYNd7bjFVugwtmG4VF0mDu/HJcIeSMTU+08aANZYkQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1748711908; a=rsa-sha256; cv=none; b=P+ZBF1+5rnxnuKuFEeLiFrAJFK6nF3E1LDQqQwf8g5MFWqQgDHulQJRBUAI8n49ZeuHq00 49nEGYGWu2IFcrrpTo/CHt8E/SVDChrM75/k6DZugfNQ9RlWw/KqFj4ycybMoq9IfNfIuX M/vy1+uZgT9BgaMwkXbUkJijBy8W8DSx/3MtVvpzRGJ3YaGz9DvTFuXXYmvqgywGQm0pqg pzgBen5vuuQkHDyPr81oaueKqs+TxW63wb/lpfL7j0W3z5vnk1DhPu2VET2Xf7N/1hJZ7g //bTBE6VP3h+ilG6lS2NLkiupwkab03h7tj2Kwd91cBiQrJToVH4IP1cGKa76A== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4b8mz80Xk1zn1R; Sat, 31 May 2025 17:18:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 54VHISW5031291; Sat, 31 May 2025 17:18:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 54VHISqo031288; Sat, 31 May 2025 17:18:28 GMT (envelope-from git) Date: Sat, 31 May 2025 17:18:28 GMT Message-Id: <202505311718.54VHISqo031288@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Daniel Engberg Subject: git: 9a596e5a5345 - main - security/vuxml: Document libxml2 vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: diizzy X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 9a596e5a5345db82dcf952243faa5e9d80d2ef1b Auto-Submitted: auto-generated The branch main has been updated by diizzy: URL: https://cgit.FreeBSD.org/ports/commit/?id=9a596e5a5345db82dcf952243faa5e9d80d2ef1b commit 9a596e5a5345db82dcf952243faa5e9d80d2ef1b Author: Daniel Engberg AuthorDate: 2025-05-31 17:17:46 +0000 Commit: Daniel Engberg CommitDate: 2025-05-31 17:17:49 +0000 security/vuxml: Document libxml2 vulnerabilities Document CVE-2024-56171, CVE-2025-24928 and CVE-2025-32414 --- security/vuxml/vuln/2025.xml | 89 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index 4681d7869854..1cd062837b12 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,92 @@ + + libxml2 -- Out-of-bounds memory access + + + xmlsoft + 2.14.2 + + + + +

cve@mitre.org reports:

+
+

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds + memory access can occur in the Python API (Python bindings) because + of an incorrect return value. This occurs in xmlPythonFileRead and + xmlPythonFileReadRaw because of a difference between bytes and + characters.

+
+ + + + CVE-2025-32414 + https://nvd.nist.gov/vuln/detail/CVE-2025-32414 + + + 2025-04-08 + 2025-05-31 + + + + + libxml2 -- Stack-based Buffer Overflow + + + libxml2 + 2.13.6 + + + + +

cve@mitre.org reports:

+
+

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based + buffer overflow in xmlSnprintfElements in valid.c. To exploit this, + DTD validation must occur for an untrusted document or untrusted + DTD. NOTE: this is similar to CVE-2017-9047.

+
+ + + + CVE-2025-24928 + https://nvd.nist.gov/vuln/detail/CVE-2025-24928 + + + 2025-02-18 + 2025-05-31 + + + + + libxml2 -- Use After Free + + + libxml2 + 2.13.6 + + + + +

cve@mitre.org reports:

+
+

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free + in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in + xmlschemas.c. To exploit this, a crafted XML document must be + validated against an XML schema with certain identity constraints, + or a crafted XML schema must be used.

+
+ + + + CVE-2024-56171 + https://nvd.nist.gov/vuln/detail/CVE-2024-56171 + + + 2025-02-18 + 2025-05-31 + + + chromium -- multiple security fixes