From: Joshua Lock <joshua.lock@collabora.co.uk>
To: openembedded-core@lists.openembedded.org
Subject: Re: [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes
Date: Wed, 16 Dec 2015 21:05:02 +0000 [thread overview]
Message-ID: <5671D1FE.7010306@collabora.co.uk> (raw)
In-Reply-To: <1449344129-32738-1-git-send-email-akuster808@gmail.com>
Hi Armin,
On 05/12/15 19:35, Armin Kuster wrote:
> Each CVE is an independant patch so they can be easily merged to other distros
> and/or stable branches.
As others have mentioned elsewhere I think this would be much nicer if
each patch was added to the SRC_URI in the same commit which introduces
the patch.
In addition, I believe it would also make sense to have 2 patches for
the same CVE applied at once?
Ideally this series would be 11 patches, each of which updated SRC_URI
and added the patch files to fix a single CVE.
What do you think? I am more than happy to take this series and make the
suggested change (11 commits, each editing SRC_URI) myself before
requesting my fido-next branch be merged?
Thanks,
Joshua
> I have included two previous CVE's sent for jethro which can be ignored.
> I put the CVE's in order as there where fixed upstream.
>
> Armin Kuster (15):
> libxml2: security fix CVE-2015-7941-1
> libxml2: security fix CVE-2015-7941-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7942
> libxml2: security fix CVE-2015-7942-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7498
> libxml2: security fix CVE-2015-7497
> libxml2: security fix CVE-2015-7499-1
> libxml2: security fix CVE-2015-7499-2
> libxml2: depend fix security issue CVE-2015-7500
> libxml2: security fix CVE-2015-7500
> libxml2: security fix CVE-2015-8242
> libxml2: security fix CVE-2015-5312
> libxml2: multiple security fixes.
>
> meta/recipes-core/libxml/libxml2.inc | 14 +++
> ...-2015-5312-Another-entity-expansion-issue.patch | 39 ++++++
> ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch | 40 ++++++
> ...00-Fix-memory-access-error-due-to-incorre.patch | 131 +++++++++++++++++++
> ...2015-8035-Fix-XZ-compression-support-loop.patch | 38 ++++++
> ...42-Buffer-overead-with-HTML-parser-in-pus.patch | 49 ++++++++
> ...n-name-parsing-at-the-end-of-current-inpu.patch | 138 +++++++++++++++++++++
> ...ssing-entities-after-encoding-conversion-.patch | 89 +++++++++++++
> ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch | 88 +++++++++++++
> ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch | 43 +++++++
> ...top-parsing-on-entities-boundaries-errors.patch | 39 ++++++
> ...leanup-conditional-section-error-handling.patch | 56 +++++++++
> ...ror-in-previous-Conditional-section-patch.patch | 35 ++++++
> ...iation-of-overflow-in-Conditional-section.patch | 39 ++++++
> ...ng-early-on-if-encoding-conversion-failed.patch | 42 +++++++
> 15 files changed, 880 insertions(+)
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch
>
next prev parent reply other threads:[~2015-12-16 21:05 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-05 19:35 [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 01/15] libxml2: security fix CVE-2015-7941-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 02/15] libxml2: security fix CVE-2015-7941-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 03/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 04/15] libxml2: security fix CVE-2015-7942 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 05/15] libxml2: security fix CVE-2015-7942-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 06/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 07/15] libxml2: security fix CVE-2015-7498 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 08/15] libxml2: security fix CVE-2015-7497 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 09/15] libxml2: security fix CVE-2015-7499-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 10/15] libxml2: security fix CVE-2015-7499-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 11/15] libxml2: depend fix security issue CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 12/15] libxml2: security fix CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 13/15] libxml2: security fix CVE-2015-8242 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 14/15] libxml2: security fix CVE-2015-5312 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 15/15] libxml2: multiple security fixes Armin Kuster
2015-12-08 8:16 ` [PATCH][jethro][fido][ 00/15] Libxml2: " Robert Yang
2015-12-16 21:05 ` Joshua Lock [this message]
2015-12-21 16:12 ` akuster808
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5671D1FE.7010306@collabora.co.uk \
--to=joshua.lock@collabora.co.uk \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox