From: Robert Yang <liezhi.yang@windriver.com>
To: Armin Kuster <akuster808@gmail.com>,
<openembedded-core@lists.openembedded.org>
Subject: Re: [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes
Date: Tue, 8 Dec 2015 16:16:01 +0800 [thread overview]
Message-ID: <566691C1.4050000@windriver.com> (raw)
In-Reply-To: <1449344129-32738-1-git-send-email-akuster808@gmail.com>
Hi Armin,
With these patches, for jethro, I think that the following one is not
needed any more ?
commit d7fa0b41843dd417eba31f1a8dcd60ce08a57d66
Author: Armin Kuster <akuster@mvista.com>
Date: Wed Nov 11 14:21:46 2015 -0800
libxml2: fix CVE-2015-7942 and CVE-2015-8035
// Robert
On 12/06/2015 03:35 AM, Armin Kuster wrote:
> Each CVE is an independant patch so they can be easily merged to other distros
> and/or stable branches.
>
> I have included two previous CVE's sent for jethro which can be ignored.
> I put the CVE's in order as there where fixed upstream.
>
> Armin Kuster (15):
> libxml2: security fix CVE-2015-7941-1
> libxml2: security fix CVE-2015-7941-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7942
> libxml2: security fix CVE-2015-7942-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7498
> libxml2: security fix CVE-2015-7497
> libxml2: security fix CVE-2015-7499-1
> libxml2: security fix CVE-2015-7499-2
> libxml2: depend fix security issue CVE-2015-7500
> libxml2: security fix CVE-2015-7500
> libxml2: security fix CVE-2015-8242
> libxml2: security fix CVE-2015-5312
> libxml2: multiple security fixes.
>
> meta/recipes-core/libxml/libxml2.inc | 14 +++
> ...-2015-5312-Another-entity-expansion-issue.patch | 39 ++++++
> ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch | 40 ++++++
> ...00-Fix-memory-access-error-due-to-incorre.patch | 131 +++++++++++++++++++
> ...2015-8035-Fix-XZ-compression-support-loop.patch | 38 ++++++
> ...42-Buffer-overead-with-HTML-parser-in-pus.patch | 49 ++++++++
> ...n-name-parsing-at-the-end-of-current-inpu.patch | 138 +++++++++++++++++++++
> ...ssing-entities-after-encoding-conversion-.patch | 89 +++++++++++++
> ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch | 88 +++++++++++++
> ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch | 43 +++++++
> ...top-parsing-on-entities-boundaries-errors.patch | 39 ++++++
> ...leanup-conditional-section-error-handling.patch | 56 +++++++++
> ...ror-in-previous-Conditional-section-patch.patch | 35 ++++++
> ...iation-of-overflow-in-Conditional-section.patch | 39 ++++++
> ...ng-early-on-if-encoding-conversion-failed.patch | 42 +++++++
> 15 files changed, 880 insertions(+)
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch
>
next prev parent reply other threads:[~2015-12-08 8:16 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-05 19:35 [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 01/15] libxml2: security fix CVE-2015-7941-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 02/15] libxml2: security fix CVE-2015-7941-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 03/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 04/15] libxml2: security fix CVE-2015-7942 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 05/15] libxml2: security fix CVE-2015-7942-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 06/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 07/15] libxml2: security fix CVE-2015-7498 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 08/15] libxml2: security fix CVE-2015-7497 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 09/15] libxml2: security fix CVE-2015-7499-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 10/15] libxml2: security fix CVE-2015-7499-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 11/15] libxml2: depend fix security issue CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 12/15] libxml2: security fix CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 13/15] libxml2: security fix CVE-2015-8242 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 14/15] libxml2: security fix CVE-2015-5312 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 15/15] libxml2: multiple security fixes Armin Kuster
2015-12-08 8:16 ` Robert Yang [this message]
2015-12-16 21:05 ` [PATCH][jethro][fido][ 00/15] Libxml2: " Joshua Lock
2015-12-21 16:12 ` akuster808
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=566691C1.4050000@windriver.com \
--to=liezhi.yang@windriver.com \
--cc=akuster808@gmail.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.