* [OE-core][kirkstone 0/4] Patch review
@ 2023-12-29 16:07 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2023-12-29 16:07 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, January 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6384
The following changes since commit 2afd9a6002cba2a23dd62a1805b4be04083c041b:
testimage: Exclude wtmp from target-dumper commands (2023-12-20 11:40:13 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (2):
openssh: fix CVE-2023-51384
openssh: fix CVE-2023-51385
Khem Raj (1):
elfutils: Disable stringop-overflow warning for build host
Steve Sakoman (1):
testimage: drop target_dumper, host_dumper, and monitor_dumper
meta/classes/testimage.bbclass | 24 ---
.../openssh/openssh/CVE-2023-51384.patch | 171 ++++++++++++++++++
.../openssh/openssh/CVE-2023-51385.patch | 97 ++++++++++
.../openssh/openssh_8.9p1.bb | 2 +
.../elfutils/elfutils_0.186.bb | 2 +
5 files changed, 272 insertions(+), 24 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-51384.patch
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2023-51385.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2024-02-01 19:37 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2024-02-01 19:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday, February 5
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6513
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6513
The following changes since commit a744a897f0ea7d34c31c024c13031221f9a85f24:
build-appliance-image: Update to kirkstone head revision (2024-01-25 04:06:50 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (1):
python3-jinja2: upgrade 3.1.1 -> 3.1.2
Lee Chee Yang (1):
xwayland: Fix CVE-2023-6377 CVE-2023-6478
Ludovic Jozeau (1):
image-live.bbclass: LIVE_ROOTFS_TYPE support compression
Wang Mingyu (1):
python3-jinja2: upgrade 3.1.2 -> 3.1.3
meta/classes/image-live.bbclass | 2 +-
...inja2_3.1.1.bb => python3-jinja2_3.1.3.bb} | 2 +-
.../xwayland/xwayland/CVE-2023-6377.patch | 82 +++++++++++++++++++
.../xwayland/xwayland/CVE-2023-6478.patch | 66 +++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
5 files changed, 152 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/python/{python3-jinja2_3.1.1.bb => python3-jinja2_3.1.3.bb} (92%)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2023-6377.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2023-6478.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2024-03-07 18:38 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2024-03-07 18:38 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday, March 11
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6658
The following changes since commit d63af11e92094487d6e358f27283e5385937e7a8:
kernel.bbclass: Set pkg-config variables for building modules (2024-03-03 11:56:20 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Chen Qi (1):
useradd-example: do not use unsupported clear text password
Fabio Estevam (1):
u-boot: Move UBOOT_INITIAL_ENV back to u-boot.inc
Hitendra Prajapati (1):
golang: Fix CVE-2023-45289 & CVE-2023-45290
Steve Sakoman (1):
selftest: skip virgl gtk/sdl test on ubuntu 18.04
.../useradd/useradd-example.bb | 4 +-
meta/classes/uboot-config.bbclass | 4 -
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
meta/recipes-bsp/u-boot/u-boot.inc | 4 +
meta/recipes-devtools/go/go-1.17.13.inc | 2 +
.../go/go-1.21/CVE-2023-45289.patch | 121 ++++++++
.../go/go-1.21/CVE-2023-45290.patch | 270 ++++++++++++++++++
7 files changed, 401 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-45289.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-45290.patch
--
2.34.1
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-01-31 14:15 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-01-31 14:15 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, February 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/911
The following changes since commit 077aab43f2c928eb8da71934405c62327010f552:
classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architecture (2025-01-20 06:06:07 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Deepesh Varatharajan (1):
glibc: stable 2.35 branch updates
Peter Marko (1):
openssl: patch CVE-2024-13176
Yash Shinde (2):
binutils: internal gdb: Fix CVE-2024-53589
gdb: Fix CVE-2024-53589
.../openssl/openssl/CVE-2024-13176.patch | 125 ++++++++++++++++++
.../openssl/openssl_3.0.15.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0037-CVE-2024-53589.patch | 92 +++++++++++++
meta/recipes-devtools/gdb/gdb.inc | 1 +
.../gdb/gdb/0014-CVE-2024-53589.patch | 92 +++++++++++++
7 files changed, 313 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-13176.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0037-CVE-2024-53589.patch
create mode 100644 meta/recipes-devtools/gdb/gdb/0014-CVE-2024-53589.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-03-27 14:43 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-03-27 14:43 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirktone and have comments back by
end of day Monday, March 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1277
The following changes since commit 1172a71f2104454a13e64886adbdb381aa8d6e0e:
libxcrypt-compat: Remove libcrypt.so to fix conflict with libcrypt (2025-03-21 06:48:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Bruce Ashfield (2):
linux-yocto/5.15: update to v5.15.179
linux-yocto/5.10: update to v5.10.234
Peter Marko (1):
python3: patch CVE-2025-0938
Vijay Anusuri (1):
vim: Upgrade 9.1.1115 -> 9.1.1198
.../python/python3/CVE-2025-0938.patch | 131 ++++++++++++++++++
.../python/python3_3.10.16.bb | 1 +
.../linux/linux-yocto-rt_5.10.bb | 6 +-
.../linux/linux-yocto-rt_5.15.bb | 6 +-
.../linux/linux-yocto-tiny_5.10.bb | 8 +-
.../linux/linux-yocto-tiny_5.15.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_5.10.bb | 24 ++--
meta/recipes-kernel/linux/linux-yocto_5.15.bb | 26 ++--
meta/recipes-support/vim/vim.inc | 4 +-
9 files changed, 172 insertions(+), 40 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-0938.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-04-15 20:52 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-04-15 20:52 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, April 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1401
The following changes since commit 7399cf17590204f8289f356cce4575592d6e3536:
ghostscript: Fix CVE-2025-27836 (2025-04-08 08:36:03 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Divya Chellam (1):
ruby: fix CVE-2024-43398
Hitendra Prajapati (1):
go: fix CVE-2025-22871
Peter Marko (2):
cve-update-nvd2-native: add workaround for json5 style list
systemd: ignore CVEs which reappeared after upgrade to 250.14
.../meta/cve-update-nvd2-native.bb | 5 +
meta/recipes-core/systemd/systemd.inc | 3 +
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.21/CVE-2025-22871.patch | 172 ++++++++++++++++++
.../ruby/ruby/CVE-2024-43398.patch | 81 +++++++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
6 files changed, 263 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2025-22871.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-43398.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-08-05 16:43 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-08-05 16:43 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, August 7
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2150
The following changes since commit b4a2f74ba0b40abcdf56c4b58cae5f7ce145d511:
sqlite3: Fix CVE-2025-6965 (2025-07-29 06:39:06 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Peter Marko (3):
sqlite3: patch CVE-2025-7458
sqlite3: ignore CVE-2025-3277
glibc: stable 2.35 branch updates
Zhang Peng (1):
avahi: fix CVE-2024-52615
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52615.patch | 228 ++++++++++++++++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../glibc/glibc/0025-CVE-2025-4802.patch | 250 ------------------
meta/recipes-core/glibc/glibc_2.35.bb | 2 +-
...mpts-to-improve-the-detection-of-cov.patch | 91 +++++++
.../sqlite/files/CVE-2025-7458.patch | 32 +++
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 4 +
8 files changed, 358 insertions(+), 252 deletions(-)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
delete mode 100644 meta/recipes-core/glibc/glibc/0025-CVE-2025-4802.patch
create mode 100644 meta/recipes-support/sqlite/files/0001-This-branch-attempts-to-improve-the-detection-of-cov.patch
create mode 100644 meta/recipes-support/sqlite/files/CVE-2025-7458.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-10-29 2:54 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-10-29 2:54 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, October 30
Passed a-full on the autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2650
The following changes since commit 9b3dbd691f6ebdbdfe88cef3d3a676ddd1399c63:
python3: upgrade 3.10.18 -> 3.10.19 (2025-10-17 07:39:27 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (1):
git: fix CVE-2025-48386
Peter Marko (1):
lz4: patch CVE-2025-62813
Yash Shinde (2):
binutils: fix CVE-2025-11081
binutils: fix CVE-2025-8225
.../binutils/binutils-2.38.inc | 2 +
.../binutils/0046-CVE-2025-11081.patch | 84 ++++++++++++++++
.../binutils/0047-CVE-2025-8225.patch | 47 +++++++++
.../git/git/CVE-2025-48386.patch | 97 +++++++++++++++++++
meta/recipes-devtools/git/git_2.35.7.bb | 1 +
.../lz4/files/CVE-2025-62813.patch | 69 +++++++++++++
meta/recipes-support/lz4/lz4_1.9.4.bb | 4 +-
7 files changed, 303 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0046-CVE-2025-11081.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0047-CVE-2025-8225.patch
create mode 100644 meta/recipes-devtools/git/git/CVE-2025-48386.patch
create mode 100644 meta/recipes-support/lz4/files/CVE-2025-62813.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-12-09 21:53 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 1/4] libxml2: Security fix for CVE-2025-7425 Steve Sakoman
` (3 more replies)
0 siblings, 4 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, December 11
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2836
The following changes since commit 80c7fd87fd95a79c6eb5f41b95cf70ccc70d9615:
systemd-bootchart: update SRC_URI branch (2025-12-01 07:13:56 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (2):
libxml2: Security fix for CVE-2025-7425
openssh: fix CVE-2025-61984
Peter Marko (2):
libpng: patch CVE-2025-66293
libmicrohttpd: disable experimental code by default
.../openssh/openssh/CVE-2025-61984.patch | 98 +++
.../openssh/openssh_8.9p1.bb | 1 +
.../libxml/libxml2/CVE-2025-7425.patch | 802 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
.../libpng/files/CVE-2025-66293-01.patch | 60 ++
.../libpng/files/CVE-2025-66293-02.patch | 125 +++
.../libpng/libpng_1.6.39.bb | 2 +
.../libmicrohttpd/libmicrohttpd_0.9.76.bb | 3 +
8 files changed, 1092 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 1/4] libxml2: Security fix for CVE-2025-7425
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
@ 2025-12-09 21:53 ` Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 2/4] libpng: patch CVE-2025-66293 Steve Sakoman
` (2 subsequent siblings)
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
CVE-2025-7425
libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption
Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6
Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libxml/libxml2/CVE-2025-7425.patch | 802 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
2 files changed, 803 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch
new file mode 100644
index 0000000000..c8c9ace82d
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2025-7425.patch
@@ -0,0 +1,802 @@
+From 87786d6200ae1f5ac98d21f04d451e17ff25a216 Mon Sep 17 00:00:00 2001
+From: David Kilzer <ddkilzer@apple.com>
+Reviewed-By: Aron Xu <aron@debian.org>
+Date: Mon, 23 Jun 2025 14:41:56 -0700
+Subject: [PATCH] libxslt: heap-use-after-free in xmlFreeID caused by `atype`
+ corruption
+
+* include/libxml/tree.h:
+(XML_ATTR_CLEAR_ATYPE): Add.
+(XML_ATTR_GET_ATYPE): Add.
+(XML_ATTR_SET_ATYPE): Add.
+(XML_NODE_ADD_EXTRA): Add.
+(XML_NODE_CLEAR_EXTRA): Add.
+(XML_NODE_GET_EXTRA): Add.
+(XML_NODE_SET_EXTRA): Add.
+(XML_DOC_ADD_PROPERTIES): Add.
+(XML_DOC_CLEAR_PROPERTIES): Add.
+(XML_DOC_GET_PROPERTIES): Add.
+(XML_DOC_SET_PROPERTIES): Add.
+- Add macros for accessing fields with upper bits that may be set by
+ libxslt.
+
+* HTMLparser.c:
+(htmlNewDocNoDtD):
+* SAX2.c:
+(xmlSAX2StartDocument):
+(xmlSAX2EndDocument):
+* parser.c:
+(xmlParseEntityDecl):
+(xmlParseExternalSubset):
+(xmlParseReference):
+(xmlCtxtParseDtd):
+* runxmlconf.c:
+(xmlconfTestInvalid):
+(xmlconfTestValid):
+* tree.c:
+(xmlNewDoc):
+(xmlFreeProp):
+(xmlNodeSetDoc):
+(xmlSetNsProp):
+(xmlDOMWrapAdoptBranch):
+* valid.c:
+(xmlFreeID):
+(xmlAddIDInternal):
+(xmlValidateAttributeValueInternal):
+(xmlValidateOneAttribute):
+(xmlValidateRef):
+* xmlreader.c:
+(xmlTextReaderStartElement):
+(xmlTextReaderStartElementNs):
+(xmlTextReaderValidateEntity):
+(xmlTextReaderRead):
+(xmlTextReaderNext):
+(xmlTextReaderIsEmptyElement):
+(xmlTextReaderPreserve):
+* xmlschemas.c:
+(xmlSchemaPValAttrNodeID):
+* xmlschemastypes.c:
+(xmlSchemaValAtomicType):
+- Adopt macros by renaming the struct fields, recompiling and fixing
+ compiler failures, then changing the struct field names back.
+Origin: https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu3.6
+Ref : https://security-tracker.debian.org/tracker/CVE-2025-7425
+
+CVE: CVE-2025-7425
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt/-/issues/140]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ HTMLparser.c | 1 +
+ SAX2.c | 6 ++--
+ include/libxml/tree.h | 14 ++++++++-
+ parser.c | 8 ++---
+ runxmlconf.c | 4 +--
+ tree.c | 20 ++++++-------
+ valid.c | 68 +++++++++++++++++++++----------------------
+ xmlreader.c | 30 +++++++++----------
+ xmlschemas.c | 4 +--
+ xmlschemastypes.c | 12 ++++----
+ 10 files changed, 90 insertions(+), 77 deletions(-)
+
+diff --git a/HTMLparser.c b/HTMLparser.c
+index e720bb2..1307f71 100644
+--- a/HTMLparser.c
++++ b/HTMLparser.c
+@@ -2514,6 +2514,7 @@ htmlNewDocNoDtD(const xmlChar *URI, const xmlChar *ExternalID) {
+ cur->refs = NULL;
+ cur->_private = NULL;
+ cur->charset = XML_CHAR_ENCODING_UTF8;
++ XML_DOC_SET_PROPERTIES(cur, XML_DOC_HTML | XML_DOC_USERBUILT);
+ cur->properties = XML_DOC_HTML | XML_DOC_USERBUILT;
+ if ((ExternalID != NULL) ||
+ (URI != NULL))
+diff --git a/SAX2.c b/SAX2.c
+index f7c77c2..0d8e84a 100644
+--- a/SAX2.c
++++ b/SAX2.c
+@@ -970,7 +970,7 @@ xmlSAX2StartDocument(void *ctx)
+ xmlSAX2ErrMemory(ctxt, "xmlSAX2StartDocument");
+ return;
+ }
+- ctxt->myDoc->properties = XML_DOC_HTML;
++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_HTML);
+ ctxt->myDoc->parseFlags = ctxt->options;
+ #else
+ xmlGenericError(xmlGenericErrorContext,
+@@ -983,9 +983,9 @@ xmlSAX2StartDocument(void *ctx)
+ } else {
+ doc = ctxt->myDoc = xmlNewDoc(ctxt->version);
+ if (doc != NULL) {
+- doc->properties = 0;
++ XML_DOC_CLEAR_PROPERTIES(doc);
+ if (ctxt->options & XML_PARSE_OLD10)
+- doc->properties |= XML_DOC_OLD10;
++ XML_DOC_ADD_PROPERTIES(doc, XML_DOC_OLD10);
+ doc->parseFlags = ctxt->options;
+ if (ctxt->encoding != NULL)
+ doc->encoding = xmlStrdup(ctxt->encoding);
+diff --git a/include/libxml/tree.h b/include/libxml/tree.h
+index 1e79be9..61178b2 100644
+--- a/include/libxml/tree.h
++++ b/include/libxml/tree.h
+@@ -365,7 +365,6 @@ struct _xmlElement {
+ #endif
+ };
+
+-
+ /**
+ * XML_LOCAL_NAMESPACE:
+ *
+@@ -446,6 +445,10 @@ struct _xmlAttr {
+ void *psvi; /* for type/PSVI information */
+ };
+
++#define XML_ATTR_CLEAR_ATYPE(attr) (((attr)->atype) = 0)
++#define XML_ATTR_GET_ATYPE(attr) (((attr)->atype) & ~(15U << 27))
++#define XML_ATTR_SET_ATYPE(attr, type) ((attr)->atype = ((((attr)->atype) & (15U << 27)) | ((type) & ~(15U << 27))))
++
+ /**
+ * xmlID:
+ *
+@@ -507,6 +510,11 @@ struct _xmlNode {
+ unsigned short extra; /* extra data for XPath/XSLT */
+ };
+
++#define XML_NODE_ADD_EXTRA(node, type) ((node)->extra |= ((type) & ~(15U << 12)))
++#define XML_NODE_CLEAR_EXTRA(node) (((node)->extra) = 0)
++#define XML_NODE_GET_EXTRA(node) (((node)->extra) & ~(15U << 12))
++#define XML_NODE_SET_EXTRA(node, type) ((node)->extra = ((((node)->extra) & (15U << 12)) | ((type) & ~(15U << 12))))
++
+ /**
+ * XML_GET_CONTENT:
+ *
+@@ -585,6 +593,10 @@ struct _xmlDoc {
+ set at the end of parsing */
+ };
+
++#define XML_DOC_ADD_PROPERTIES(doc, type) ((doc)->properties |= ((type) & ~(15U << 27)))
++#define XML_DOC_CLEAR_PROPERTIES(doc) (((doc)->properties) = 0)
++#define XML_DOC_GET_PROPERTIES(doc) (((doc)->properties) & ~(15U << 27))
++#define XML_DOC_SET_PROPERTIES(doc, type) ((doc)->properties = ((((doc)->properties) & (15U << 27)) | ((type) & ~(15U << 27))))
+
+ typedef struct _xmlDOMWrapCtxt xmlDOMWrapCtxt;
+ typedef xmlDOMWrapCtxt *xmlDOMWrapCtxtPtr;
+diff --git a/parser.c b/parser.c
+index 738dbee..772d883 100644
+--- a/parser.c
++++ b/parser.c
+@@ -5523,7 +5523,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
+ xmlErrMemory(ctxt, "New Doc failed");
+ return;
+ }
+- ctxt->myDoc->properties = XML_DOC_INTERNAL;
++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL);
+ }
+ if (ctxt->myDoc->intSubset == NULL)
+ ctxt->myDoc->intSubset = xmlNewDtd(ctxt->myDoc,
+@@ -5594,7 +5594,7 @@ xmlParseEntityDecl(xmlParserCtxtPtr ctxt) {
+ xmlErrMemory(ctxt, "New Doc failed");
+ return;
+ }
+- ctxt->myDoc->properties = XML_DOC_INTERNAL;
++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL);
+ }
+
+ if (ctxt->myDoc->intSubset == NULL)
+@@ -7035,7 +7035,7 @@ xmlParseExternalSubset(xmlParserCtxtPtr ctxt, const xmlChar *ExternalID,
+ xmlErrMemory(ctxt, "New Doc failed");
+ return;
+ }
+- ctxt->myDoc->properties = XML_DOC_INTERNAL;
++ XML_DOC_SET_PROPERTIES(ctxt->myDoc, XML_DOC_INTERNAL);
+ }
+ if ((ctxt->myDoc != NULL) && (ctxt->myDoc->intSubset == NULL))
+ xmlCreateIntSubset(ctxt->myDoc, NULL, ExternalID, SystemID);
+@@ -7419,7 +7419,7 @@ xmlParseReference(xmlParserCtxtPtr ctxt) {
+ (nw != NULL) &&
+ (nw->type == XML_ELEMENT_NODE) &&
+ (nw->children == NULL))
+- nw->extra = 1;
++ XML_NODE_SET_EXTRA(nw, 1);
+
+ break;
+ }
+diff --git a/runxmlconf.c b/runxmlconf.c
+index f43fdd3..82b7241 100644
+--- a/runxmlconf.c
++++ b/runxmlconf.c
+@@ -197,7 +197,7 @@ xmlconfTestInvalid(const char *id, const char *filename, int options) {
+ id, filename);
+ } else {
+ /* invalidity should be reported both in the context and in the document */
+- if ((ctxt->valid != 0) || (doc->properties & XML_DOC_DTDVALID)) {
++ if ((ctxt->valid != 0) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_DTDVALID)) {
+ test_log("test %s : %s failed to detect invalid document\n",
+ id, filename);
+ nb_errors++;
+@@ -229,7 +229,7 @@ xmlconfTestValid(const char *id, const char *filename, int options) {
+ ret = 0;
+ } else {
+ /* validity should be reported both in the context and in the document */
+- if ((ctxt->valid == 0) || ((doc->properties & XML_DOC_DTDVALID) == 0)) {
++ if ((ctxt->valid == 0) || ((XML_DOC_GET_PROPERTIES(doc) & XML_DOC_DTDVALID) == 0)) {
+ test_log("test %s : %s failed to validate a valid document\n",
+ id, filename);
+ nb_errors++;
+diff --git a/tree.c b/tree.c
+index cdf863c..3bac0b8 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1192,7 +1192,7 @@ xmlNewDoc(const xmlChar *version) {
+ cur->compression = -1; /* not initialized */
+ cur->doc = cur;
+ cur->parseFlags = 0;
+- cur->properties = XML_DOC_USERBUILT;
++ XML_DOC_SET_PROPERTIES(cur, XML_DOC_USERBUILT);
+ /*
+ * The in memory encoding is always UTF8
+ * This field will never change and would
+@@ -2119,7 +2119,7 @@ xmlFreeProp(xmlAttrPtr cur) {
+ xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
+
+ /* Check for ID removal -> leading to invalid references ! */
+- if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
++ if ((cur->doc != NULL) && (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_ID)) {
+ xmlRemoveID(cur->doc, cur);
+ }
+ if (cur->children != NULL) xmlFreeNodeList(cur->children);
+@@ -2838,7 +2838,7 @@ xmlSetTreeDoc(xmlNodePtr tree, xmlDocPtr doc) {
+ if(tree->type == XML_ELEMENT_NODE) {
+ prop = tree->properties;
+ while (prop != NULL) {
+- if (prop->atype == XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID) {
+ xmlRemoveID(tree->doc, prop);
+ }
+
+@@ -6953,9 +6953,9 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar *name,
+ /*
+ * Modify the attribute's value.
+ */
+- if (prop->atype == XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID) {
+ xmlRemoveID(node->doc, prop);
+- prop->atype = XML_ATTRIBUTE_ID;
++ XML_ATTR_SET_ATYPE(prop, XML_ATTRIBUTE_ID);
+ }
+ if (prop->children != NULL)
+ xmlFreeNodeList(prop->children);
+@@ -6975,7 +6975,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar *name,
+ tmp = tmp->next;
+ }
+ }
+- if (prop->atype == XML_ATTRIBUTE_ID)
++ if (XML_ATTR_GET_ATYPE(prop) == XML_ATTRIBUTE_ID)
+ xmlAddID(NULL, node->doc, value, prop);
+ return(prop);
+ }
+@@ -9252,7 +9252,7 @@ ns_end:
+ if (cur->type == XML_ELEMENT_NODE) {
+ cur->psvi = NULL;
+ cur->line = 0;
+- cur->extra = 0;
++ XML_NODE_CLEAR_EXTRA(cur);
+ /*
+ * Walk attributes.
+ */
+@@ -9268,11 +9268,11 @@ ns_end:
+ * Attributes.
+ */
+ if ((sourceDoc != NULL) &&
+- (((xmlAttrPtr) cur)->atype == XML_ATTRIBUTE_ID))
++ (XML_ATTR_GET_ATYPE((xmlAttrPtr) cur) == XML_ATTRIBUTE_ID))
+ {
+ xmlRemoveID(sourceDoc, (xmlAttrPtr) cur);
+ }
+- ((xmlAttrPtr) cur)->atype = 0;
++ XML_ATTR_CLEAR_ATYPE((xmlAttrPtr) cur);
+ ((xmlAttrPtr) cur)->psvi = NULL;
+ }
+ break;
+@@ -9992,7 +9992,7 @@ xmlDOMWrapAdoptAttr(xmlDOMWrapCtxtPtr ctxt,
+ }
+
+ XML_TREE_ADOPT_STR(attr->name);
+- attr->atype = 0;
++ XML_ATTR_CLEAR_ATYPE(attr);
+ attr->psvi = NULL;
+ /*
+ * Walk content.
+diff --git a/valid.c b/valid.c
+index 36a0435..8e76cfa 100644
+--- a/valid.c
++++ b/valid.c
+@@ -1906,7 +1906,7 @@ xmlScanIDAttributeDecl(xmlValidCtxtPtr ctxt, xmlElementPtr elem, int err) {
+ if (elem == NULL) return(0);
+ cur = elem->attributes;
+ while (cur != NULL) {
+- if (cur->atype == XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_ID) {
+ ret ++;
+ if ((ret > 1) && (err))
+ xmlErrValidNode(ctxt, (xmlNodePtr) elem, XML_DTD_MULTIPLE_ID,
+@@ -2279,7 +2279,7 @@ xmlDumpAttributeDecl(xmlBufferPtr buf, xmlAttributePtr attr) {
+ xmlBufferWriteChar(buf, ":");
+ }
+ xmlBufferWriteCHAR(buf, attr->name);
+- switch (attr->atype) {
++ switch (XML_ATTR_GET_ATYPE(attr)) {
+ case XML_ATTRIBUTE_CDATA:
+ xmlBufferWriteChar(buf, " CDATA");
+ break;
+@@ -2758,7 +2758,7 @@ xmlAddID(xmlValidCtxtPtr ctxt, xmlDocPtr doc, const xmlChar *value,
+ return(NULL);
+ }
+ if (attr != NULL)
+- attr->atype = XML_ATTRIBUTE_ID;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID);
+ return(ret);
+ }
+
+@@ -2837,7 +2837,7 @@ xmlIsID(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) {
+ if ((fullelemname != felem) && (fullelemname != elem->name))
+ xmlFree(fullelemname);
+
+- if ((attrDecl != NULL) && (attrDecl->atype == XML_ATTRIBUTE_ID))
++ if ((attrDecl != NULL) && (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ID))
+ return(1);
+ }
+ return(0);
+@@ -2878,7 +2878,7 @@ xmlRemoveID(xmlDocPtr doc, xmlAttrPtr attr) {
+
+ xmlHashRemoveEntry(table, ID, xmlFreeIDTableEntry);
+ xmlFree(ID);
+- attr->atype = 0;
++ XML_ATTR_CLEAR_ATYPE(attr);
+ return(0);
+ }
+
+@@ -3157,8 +3157,8 @@ xmlIsRef(xmlDocPtr doc, xmlNodePtr elem, xmlAttrPtr attr) {
+ elem->name, attr->name);
+
+ if ((attrDecl != NULL) &&
+- (attrDecl->atype == XML_ATTRIBUTE_IDREF ||
+- attrDecl->atype == XML_ATTRIBUTE_IDREFS))
++ (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREF ||
++ XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREFS))
+ return(1);
+ }
+ return(0);
+@@ -3532,7 +3532,7 @@ xmlIsMixedElement(xmlDocPtr doc, const xmlChar *name) {
+
+ static int
+ xmlIsDocNameStartChar(xmlDocPtr doc, int c) {
+- if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) {
++ if ((doc == NULL) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_OLD10) == 0) {
+ /*
+ * Use the new checks of production [4] [4a] amd [5] of the
+ * Update 5 of XML-1.0
+@@ -3562,7 +3562,7 @@ xmlIsDocNameStartChar(xmlDocPtr doc, int c) {
+
+ static int
+ xmlIsDocNameChar(xmlDocPtr doc, int c) {
+- if ((doc == NULL) || (doc->properties & XML_DOC_OLD10) == 0) {
++ if ((doc == NULL) || (XML_DOC_GET_PROPERTIES(doc) & XML_DOC_OLD10) == 0) {
+ /*
+ * Use the new checks of production [4] [4a] amd [5] of the
+ * Update 5 of XML-1.0
+@@ -4112,7 +4112,7 @@ xmlValidCtxtNormalizeAttributeValue(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+
+ if (attrDecl == NULL)
+ return(NULL);
+- if (attrDecl->atype == XML_ATTRIBUTE_CDATA)
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_CDATA)
+ return(NULL);
+
+ ret = xmlStrdup(value);
+@@ -4174,7 +4174,7 @@ xmlValidNormalizeAttributeValue(xmlDocPtr doc, xmlNodePtr elem,
+
+ if (attrDecl == NULL)
+ return(NULL);
+- if (attrDecl->atype == XML_ATTRIBUTE_CDATA)
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_CDATA)
+ return(NULL);
+
+ ret = xmlStrdup(value);
+@@ -4189,7 +4189,7 @@ xmlValidateAttributeIdCallback(void *payload, void *data,
+ const xmlChar *name ATTRIBUTE_UNUSED) {
+ xmlAttributePtr attr = (xmlAttributePtr) payload;
+ int *count = (int *) data;
+- if (attr->atype == XML_ATTRIBUTE_ID) (*count)++;
++ if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID) (*count)++;
+ }
+
+ /**
+@@ -4221,7 +4221,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ /* Attribute Default Legal */
+ /* Enumeration */
+ if (attr->defaultValue != NULL) {
+- val = xmlValidateAttributeValueInternal(doc, attr->atype,
++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attr),
+ attr->defaultValue);
+ if (val == 0) {
+ xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ATTRIBUTE_DEFAULT,
+@@ -4232,7 +4232,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ }
+
+ /* ID Attribute Default */
+- if ((attr->atype == XML_ATTRIBUTE_ID)&&
++ if ((XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID)&&
+ (attr->def != XML_ATTRIBUTE_IMPLIED) &&
+ (attr->def != XML_ATTRIBUTE_REQUIRED)) {
+ xmlErrValidNode(ctxt, (xmlNodePtr) attr, XML_DTD_ID_FIXED,
+@@ -4242,7 +4242,7 @@ xmlValidateAttributeDecl(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ }
+
+ /* One ID per Element Type */
+- if (attr->atype == XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_ID) {
+ int nbId;
+
+ /* the trick is that we parse DtD as their own internal subset */
+@@ -4501,9 +4501,9 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ attr->name, elem->name, NULL);
+ return(0);
+ }
+- attr->atype = attrDecl->atype;
++ XML_ATTR_SET_ATYPE(attr, attrDecl->atype);
+
+- val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value);
++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attrDecl), value);
+ if (val == 0) {
+ xmlErrValidNode(ctxt, elem, XML_DTD_ATTRIBUTE_VALUE,
+ "Syntax of value for attribute %s of %s is not valid\n",
+@@ -4522,19 +4522,19 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ }
+
+ /* Validity Constraint: ID uniqueness */
+- if (attrDecl->atype == XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ID) {
+ if (xmlAddID(ctxt, doc, value, attr) == NULL)
+ ret = 0;
+ }
+
+- if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) ||
+- (attrDecl->atype == XML_ATTRIBUTE_IDREFS)) {
++ if ((XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREF) ||
++ (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_IDREFS)) {
+ if (xmlAddRef(ctxt, doc, value, attr) == NULL)
+ ret = 0;
+ }
+
+ /* Validity Constraint: Notation Attributes */
+- if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_NOTATION) {
+ xmlEnumerationPtr tree = attrDecl->tree;
+ xmlNotationPtr nota;
+
+@@ -4564,7 +4564,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+ }
+
+ /* Validity Constraint: Enumeration */
+- if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) {
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ENUMERATION) {
+ xmlEnumerationPtr tree = attrDecl->tree;
+ while (tree != NULL) {
+ if (xmlStrEqual(tree->name, value)) break;
+@@ -4589,7 +4589,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr doc,
+
+ /* Extra check for the attribute value */
+ ret &= xmlValidateAttributeValue2(ctxt, doc, attr->name,
+- attrDecl->atype, value);
++ XML_ATTR_GET_ATYPE(attrDecl), value);
+
+ return(ret);
+ }
+@@ -4688,7 +4688,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
+ return(0);
+ }
+
+- val = xmlValidateAttributeValueInternal(doc, attrDecl->atype, value);
++ val = xmlValidateAttributeValueInternal(doc, XML_ATTR_GET_ATYPE(attrDecl), value);
+ if (val == 0) {
+ if (ns->prefix != NULL) {
+ xmlErrValidNode(ctxt, elem, XML_DTD_INVALID_DEFAULT,
+@@ -4738,7 +4738,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
+ #endif
+
+ /* Validity Constraint: Notation Attributes */
+- if (attrDecl->atype == XML_ATTRIBUTE_NOTATION) {
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_NOTATION) {
+ xmlEnumerationPtr tree = attrDecl->tree;
+ xmlNotationPtr nota;
+
+@@ -4780,7 +4780,7 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
+ }
+
+ /* Validity Constraint: Enumeration */
+- if (attrDecl->atype == XML_ATTRIBUTE_ENUMERATION) {
++ if (XML_ATTR_GET_ATYPE(attrDecl) == XML_ATTRIBUTE_ENUMERATION) {
+ xmlEnumerationPtr tree = attrDecl->tree;
+ while (tree != NULL) {
+ if (xmlStrEqual(tree->name, value)) break;
+@@ -4818,10 +4818,10 @@ xmlNodePtr elem, const xmlChar *prefix, xmlNsPtr ns, const xmlChar *value) {
+ /* Extra check for the attribute value */
+ if (ns->prefix != NULL) {
+ ret &= xmlValidateAttributeValue2(ctxt, doc, ns->prefix,
+- attrDecl->atype, value);
++ XML_ATTR_GET_ATYPE(attrDecl), value);
+ } else {
+ ret &= xmlValidateAttributeValue2(ctxt, doc, BAD_CAST "xmlns",
+- attrDecl->atype, value);
++ XML_ATTR_GET_ATYPE(attrDecl), value);
+ }
+
+ return(ret);
+@@ -6574,7 +6574,7 @@ xmlValidateRef(xmlRefPtr ref, xmlValidCtxtPtr ctxt,
+ while (IS_BLANK_CH(*cur)) cur++;
+ }
+ xmlFree(dup);
+- } else if (attr->atype == XML_ATTRIBUTE_IDREF) {
++ } else if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_IDREF) {
+ id = xmlGetID(ctxt->doc, name);
+ if (id == NULL) {
+ xmlErrValidNode(ctxt, attr->parent, XML_DTD_UNKNOWN_ID,
+@@ -6582,7 +6582,7 @@ xmlValidateRef(xmlRefPtr ref, xmlValidCtxtPtr ctxt,
+ attr->name, name, NULL);
+ ctxt->valid = 0;
+ }
+- } else if (attr->atype == XML_ATTRIBUTE_IDREFS) {
++ } else if (XML_ATTR_GET_ATYPE(attr) == XML_ATTRIBUTE_IDREFS) {
+ xmlChar *dup, *str = NULL, *cur, save;
+
+ dup = xmlStrdup(name);
+@@ -6782,7 +6782,7 @@ xmlValidateAttributeCallback(void *payload, void *data,
+
+ if (cur == NULL)
+ return;
+- switch (cur->atype) {
++ switch (XML_ATTR_GET_ATYPE(cur)) {
+ case XML_ATTRIBUTE_CDATA:
+ case XML_ATTRIBUTE_ID:
+ case XML_ATTRIBUTE_IDREF :
+@@ -6797,7 +6797,7 @@ xmlValidateAttributeCallback(void *payload, void *data,
+ if (cur->defaultValue != NULL) {
+
+ ret = xmlValidateAttributeValue2(ctxt, ctxt->doc, cur->name,
+- cur->atype, cur->defaultValue);
++ XML_ATTR_GET_ATYPE(cur), cur->defaultValue);
+ if ((ret == 0) && (ctxt->valid == 1))
+ ctxt->valid = 0;
+ }
+@@ -6805,14 +6805,14 @@ xmlValidateAttributeCallback(void *payload, void *data,
+ xmlEnumerationPtr tree = cur->tree;
+ while (tree != NULL) {
+ ret = xmlValidateAttributeValue2(ctxt, ctxt->doc,
+- cur->name, cur->atype, tree->name);
++ cur->name, XML_ATTR_GET_ATYPE(cur), tree->name);
+ if ((ret == 0) && (ctxt->valid == 1))
+ ctxt->valid = 0;
+ tree = tree->next;
+ }
+ }
+ }
+- if (cur->atype == XML_ATTRIBUTE_NOTATION) {
++ if (XML_ATTR_GET_ATYPE(cur) == XML_ATTRIBUTE_NOTATION) {
+ doc = cur->doc;
+ if (cur->elem == NULL) {
+ xmlErrValid(ctxt, XML_ERR_INTERNAL_ERROR,
+diff --git a/xmlreader.c b/xmlreader.c
+index 67ff2cd..2a1a66a 100644
+--- a/xmlreader.c
++++ b/xmlreader.c
+@@ -753,7 +753,7 @@ xmlTextReaderStartElement(void *ctx, const xmlChar *fullname,
+ if ((ctxt->node != NULL) && (ctxt->input != NULL) &&
+ (ctxt->input->cur != NULL) && (ctxt->input->cur[0] == '/') &&
+ (ctxt->input->cur[1] == '>'))
+- ctxt->node->extra = NODE_IS_EMPTY;
++ XML_NODE_SET_EXTRA(ctxt->node, NODE_IS_EMPTY);
+ }
+ if (reader != NULL)
+ reader->state = XML_TEXTREADER_ELEMENT;
+@@ -818,7 +818,7 @@ xmlTextReaderStartElementNs(void *ctx,
+ if ((ctxt->node != NULL) && (ctxt->input != NULL) &&
+ (ctxt->input->cur != NULL) && (ctxt->input->cur[0] == '/') &&
+ (ctxt->input->cur[1] == '>'))
+- ctxt->node->extra = NODE_IS_EMPTY;
++ XML_NODE_SET_EXTRA(ctxt->node, NODE_IS_EMPTY);
+ }
+ if (reader != NULL)
+ reader->state = XML_TEXTREADER_ELEMENT;
+@@ -1216,7 +1216,7 @@ skip_children:
+ xmlNodePtr tmp;
+ if (reader->entNr == 0) {
+ while ((tmp = node->last) != NULL) {
+- if ((tmp->extra & NODE_IS_PRESERVED) == 0) {
++ if ((XML_NODE_GET_EXTRA(tmp) & NODE_IS_PRESERVED) == 0) {
+ xmlUnlinkNode(tmp);
+ xmlTextReaderFreeNode(reader, tmp);
+ } else
+@@ -1467,7 +1467,7 @@ get_next_node:
+ if ((oldstate == XML_TEXTREADER_ELEMENT) &&
+ (reader->node->type == XML_ELEMENT_NODE) &&
+ (reader->node->children == NULL) &&
+- ((reader->node->extra & NODE_IS_EMPTY) == 0)
++ ((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) == 0)
+ #ifdef LIBXML_XINCLUDE_ENABLED
+ && (reader->in_xinclude <= 0)
+ #endif
+@@ -1481,7 +1481,7 @@ get_next_node:
+ xmlTextReaderValidatePop(reader);
+ #endif /* LIBXML_REGEXP_ENABLED */
+ if ((reader->preserves > 0) &&
+- (reader->node->extra & NODE_IS_SPRESERVED))
++ (XML_NODE_GET_EXTRA(reader->node) & NODE_IS_SPRESERVED))
+ reader->preserves--;
+ reader->node = reader->node->next;
+ reader->state = XML_TEXTREADER_ELEMENT;
+@@ -1497,7 +1497,7 @@ get_next_node:
+ (reader->node->prev != NULL) &&
+ (reader->node->prev->type != XML_DTD_NODE)) {
+ xmlNodePtr tmp = reader->node->prev;
+- if ((tmp->extra & NODE_IS_PRESERVED) == 0) {
++ if ((XML_NODE_GET_EXTRA(tmp) & NODE_IS_PRESERVED) == 0) {
+ if (oldnode == tmp)
+ oldnode = NULL;
+ xmlUnlinkNode(tmp);
+@@ -1510,7 +1510,7 @@ get_next_node:
+ if ((oldstate == XML_TEXTREADER_ELEMENT) &&
+ (reader->node->type == XML_ELEMENT_NODE) &&
+ (reader->node->children == NULL) &&
+- ((reader->node->extra & NODE_IS_EMPTY) == 0)) {;
++ ((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) == 0)) {;
+ reader->state = XML_TEXTREADER_END;
+ goto node_found;
+ }
+@@ -1519,7 +1519,7 @@ get_next_node:
+ xmlTextReaderValidatePop(reader);
+ #endif /* LIBXML_REGEXP_ENABLED */
+ if ((reader->preserves > 0) &&
+- (reader->node->extra & NODE_IS_SPRESERVED))
++ (XML_NODE_GET_EXTRA(reader->node) & NODE_IS_SPRESERVED))
+ reader->preserves--;
+ reader->node = reader->node->parent;
+ if ((reader->node == NULL) ||
+@@ -1546,7 +1546,7 @@ get_next_node:
+ #endif
+ (reader->entNr == 0) &&
+ (oldnode->type != XML_DTD_NODE) &&
+- ((oldnode->extra & NODE_IS_PRESERVED) == 0)) {
++ ((XML_NODE_GET_EXTRA(oldnode) & NODE_IS_PRESERVED) == 0)) {
+ xmlUnlinkNode(oldnode);
+ xmlTextReaderFreeNode(reader, oldnode);
+ }
+@@ -1559,7 +1559,7 @@ get_next_node:
+ #endif
+ (reader->entNr == 0) &&
+ (reader->node->last != NULL) &&
+- ((reader->node->last->extra & NODE_IS_PRESERVED) == 0)) {
++ ((XML_NODE_GET_EXTRA(reader->node->last) & NODE_IS_PRESERVED) == 0)) {
+ xmlNodePtr tmp = reader->node->last;
+ xmlUnlinkNode(tmp);
+ xmlTextReaderFreeNode(reader, tmp);
+@@ -1741,7 +1741,7 @@ xmlTextReaderNext(xmlTextReaderPtr reader) {
+ return(xmlTextReaderRead(reader));
+ if (reader->state == XML_TEXTREADER_END || reader->state == XML_TEXTREADER_BACKTRACK)
+ return(xmlTextReaderRead(reader));
+- if (cur->extra & NODE_IS_EMPTY)
++ if (XML_NODE_GET_EXTRA(cur) & NODE_IS_EMPTY)
+ return(xmlTextReaderRead(reader));
+ do {
+ ret = xmlTextReaderRead(reader);
+@@ -3167,7 +3167,7 @@ xmlTextReaderIsEmptyElement(xmlTextReaderPtr reader) {
+ if (reader->in_xinclude > 0)
+ return(1);
+ #endif
+- return((reader->node->extra & NODE_IS_EMPTY) != 0);
++ return((XML_NODE_GET_EXTRA(reader->node) & NODE_IS_EMPTY) != 0);
+ }
+
+ /**
+@@ -4035,15 +4035,15 @@ xmlTextReaderPreserve(xmlTextReaderPtr reader) {
+ return(NULL);
+
+ if ((cur->type != XML_DOCUMENT_NODE) && (cur->type != XML_DTD_NODE)) {
+- cur->extra |= NODE_IS_PRESERVED;
+- cur->extra |= NODE_IS_SPRESERVED;
++ XML_NODE_ADD_EXTRA(cur, NODE_IS_PRESERVED);
++ XML_NODE_ADD_EXTRA(cur, NODE_IS_SPRESERVED);
+ }
+ reader->preserves++;
+
+ parent = cur->parent;;
+ while (parent != NULL) {
+ if (parent->type == XML_ELEMENT_NODE)
+- parent->extra |= NODE_IS_PRESERVED;
++ XML_NODE_ADD_EXTRA(parent, NODE_IS_PRESERVED);
+ parent = parent->parent;
+ }
+ return(cur);
+diff --git a/xmlschemas.c b/xmlschemas.c
+index a2dd6cf..2e6c349 100644
+--- a/xmlschemas.c
++++ b/xmlschemas.c
+@@ -6024,7 +6024,7 @@ xmlSchemaPValAttrNodeID(xmlSchemaParserCtxtPtr ctxt, xmlAttrPtr attr)
+ /*
+ * NOTE: the IDness might have already be declared in the DTD
+ */
+- if (attr->atype != XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(attr) != XML_ATTRIBUTE_ID) {
+ xmlIDPtr res;
+ xmlChar *strip;
+
+@@ -6047,7 +6047,7 @@ xmlSchemaPValAttrNodeID(xmlSchemaParserCtxtPtr ctxt, xmlAttrPtr attr)
+ NULL, NULL, "Duplicate value '%s' of simple "
+ "type 'xs:ID'", value, NULL);
+ } else
+- attr->atype = XML_ATTRIBUTE_ID;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID);
+ }
+ } else if (ret > 0) {
+ ret = XML_SCHEMAP_S4S_ATTR_INVALID_VALUE;
+diff --git a/xmlschemastypes.c b/xmlschemastypes.c
+index af31be5..d40da49 100644
+--- a/xmlschemastypes.c
++++ b/xmlschemastypes.c
+@@ -2867,7 +2867,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ /*
+ * NOTE: the IDness might have already be declared in the DTD
+ */
+- if (attr->atype != XML_ATTRIBUTE_ID) {
++ if (XML_ATTR_GET_ATYPE(attr) != XML_ATTRIBUTE_ID) {
+ xmlIDPtr res;
+ xmlChar *strip;
+
+@@ -2880,7 +2880,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ if (res == NULL) {
+ ret = 2;
+ } else {
+- attr->atype = XML_ATTRIBUTE_ID;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ID);
+ }
+ }
+ }
+@@ -2905,7 +2905,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ xmlFree(strip);
+ } else
+ xmlAddRef(NULL, node->doc, value, attr);
+- attr->atype = XML_ATTRIBUTE_IDREF;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_IDREF);
+ }
+ goto done;
+ case XML_SCHEMAS_IDREFS:
+@@ -2919,7 +2919,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ (node->type == XML_ATTRIBUTE_NODE)) {
+ xmlAttrPtr attr = (xmlAttrPtr) node;
+
+- attr->atype = XML_ATTRIBUTE_IDREFS;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_IDREFS);
+ }
+ goto done;
+ case XML_SCHEMAS_ENTITY:{
+@@ -2950,7 +2950,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ (node->type == XML_ATTRIBUTE_NODE)) {
+ xmlAttrPtr attr = (xmlAttrPtr) node;
+
+- attr->atype = XML_ATTRIBUTE_ENTITY;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ENTITY);
+ }
+ goto done;
+ }
+@@ -2967,7 +2967,7 @@ xmlSchemaValAtomicType(xmlSchemaTypePtr type, const xmlChar * value,
+ (node->type == XML_ATTRIBUTE_NODE)) {
+ xmlAttrPtr attr = (xmlAttrPtr) node;
+
+- attr->atype = XML_ATTRIBUTE_ENTITIES;
++ XML_ATTR_SET_ATYPE(attr, XML_ATTRIBUTE_ENTITIES);
+ }
+ goto done;
+ case XML_SCHEMAS_NOTATION:{
+--
+2.50.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 932251da98..05a7dce95b 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -43,6 +43,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt
file://CVE-2025-49794-CVE-2025-49796.patch \
file://CVE-2025-6170.patch \
file://CVE-2025-9714.patch \
+ file://CVE-2025-7425.patch \
"
SRC_URI[archive.sha256sum] = "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 2/4] libpng: patch CVE-2025-66293
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 1/4] libxml2: Security fix for CVE-2025-7425 Steve Sakoman
@ 2025-12-09 21:53 ` Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 3/4] openssh: fix CVE-2025-61984 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 4/4] libmicrohttpd: disable experimental code by default Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patches per nvd report [1] and github advisory [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-66293
[2] https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libpng/files/CVE-2025-66293-01.patch | 60 +++++++++
.../libpng/files/CVE-2025-66293-02.patch | 125 ++++++++++++++++++
.../libpng/libpng_1.6.39.bb | 2 +
3 files changed, 187 insertions(+)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
new file mode 100644
index 0000000000..d3db455cdf
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-01.patch
@@ -0,0 +1,60 @@
+From 788a624d7387a758ffd5c7ab010f1870dea753a1 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Sat, 29 Nov 2025 00:39:16 +0200
+Subject: [PATCH] Fix an out-of-bounds read in `png_image_read_composite`
+
+Add a defensive bounds check before calling PNG_sRGB_FROM_LINEAR to
+prevent reading up to 506 entries (1012 bytes) past `png_sRGB_base[]`.
+
+For palette images with gamma, `png_init_read_transformations`
+clears PNG_COMPOSE after compositing on the palette, but it leaves
+PNG_FLAG_OPTIMIZE_ALPHA set. The simplified API then calls
+`png_image_read_composite` with sRGB data (not linear premultiplied),
+causing the index to reach 1017. (The maximum valid index is 511.)
+
+NOTE:
+This is a defensive fix that addresses the security issue (out-of-bounds
+read) but *NOT* the correctness issue (wrong output). When the clamp
+triggers, the affected pixels are clamped to white instead of the
+correct composited color. Valid PNG images may render incorrectly with
+the simplified API.
+
+TODO:
+We already know the root cause is a flag synchronization error.
+For palette images with gamma, `png_init_read_transformations`
+clears PNG_COMPOSE but leaves PNG_FLAG_OPTIMIZE_ALPHA set, causing
+`png_image_read_composite` to misinterpret sRGB data as linear
+premultiplied. However, we have yet to implement an architectural fix
+that requires coordinating the simplified API with the transformation
+pipeline.
+
+Reported-by: flyfish101 <flyfish101@users.noreply.github.com>
+
+CVE: CVE-2025-66293
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ pngread.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/pngread.c b/pngread.c
+index 79917daaa..ab62edd9d 100644
+--- a/pngread.c
++++ b/pngread.c
+@@ -3404,9 +3404,14 @@ png_image_read_composite(png_voidp argument)
+ component += (255-alpha)*png_sRGB_table[outrow[c]];
+
+ /* So 'component' is scaled by 255*65535 and is
+- * therefore appropriate for the sRGB to linear
+- * conversion table.
++ * therefore appropriate for the sRGB-to-linear
++ * conversion table. Clamp to the valid range
++ * as a defensive measure against an internal
++ * libpng bug where the data is sRGB rather than
++ * linear premultiplied.
+ */
++ if (component > 255*65535)
++ component = 255*65535;
+ component = PNG_sRGB_FROM_LINEAR(component);
+ }
+
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
new file mode 100644
index 0000000000..e725f1e0f2
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2025-66293-02.patch
@@ -0,0 +1,125 @@
+From a05a48b756de63e3234ea6b3b938b8f5f862484a Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Mon, 1 Dec 2025 22:31:54 +0200
+Subject: [PATCH] Finalize the fix for out-of-bounds read in
+ `png_image_read_composite`
+
+Following up on commit 788a624d7387a758ffd5c7ab010f1870dea753a1.
+
+The previous commit added a defensive bounds check to address the
+security issue (out-of-bounds read), but noted that the correctness
+issue remained: when the clamp triggered, the affected pixels were
+clamped to white instead of the correct composited color.
+
+This commit addresses the correctness issue by fixing the flag
+synchronization error identified in the previous commit's TODO:
+
+1. In `png_init_read_transformations`:
+ Clear PNG_FLAG_OPTIMIZE_ALPHA when clearing PNG_COMPOSE for palette
+ images. This correctly signals that the data is sRGB, not linear
+ premultiplied.
+
+2. In `png_image_read_composite`:
+ Check PNG_FLAG_OPTIMIZE_ALPHA and use the appropriate composition
+ formula. When set, use the existing linear composition. When cleared
+ (palette composition already done), use sRGB composition to match
+ what was done to the palette.
+
+Retain the previous clamp to the valid range as belt-and-suspenders
+protection against any other unforeseen cases.
+
+CVE: CVE-2025-66293
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ pngread.c | 56 ++++++++++++++++++++++++++++++++++++------------------
+ pngrtran.c | 1 +
+ 2 files changed, 39 insertions(+), 18 deletions(-)
+
+diff --git a/pngread.c b/pngread.c
+index ab62edd9d..f8ca2b7e3 100644
+--- a/pngread.c
++++ b/pngread.c
+@@ -3338,6 +3338,7 @@ png_image_read_composite(png_voidp argument)
+ ptrdiff_t step_row = display->row_bytes;
+ unsigned int channels =
+ (image->format & PNG_FORMAT_FLAG_COLOR) != 0 ? 3 : 1;
++ int optimize_alpha = (png_ptr->flags & PNG_FLAG_OPTIMIZE_ALPHA) != 0;
+ int pass;
+
+ for (pass = 0; pass < passes; ++pass)
+@@ -3394,25 +3395,44 @@ png_image_read_composite(png_voidp argument)
+
+ if (alpha < 255) /* else just use component */
+ {
+- /* This is PNG_OPTIMIZED_ALPHA, the component value
+- * is a linear 8-bit value. Combine this with the
+- * current outrow[c] value which is sRGB encoded.
+- * Arithmetic here is 16-bits to preserve the output
+- * values correctly.
+- */
+- component *= 257*255; /* =65535 */
+- component += (255-alpha)*png_sRGB_table[outrow[c]];
++ if (optimize_alpha != 0)
++ {
++ /* This is PNG_OPTIMIZED_ALPHA, the component value
++ * is a linear 8-bit value. Combine this with the
++ * current outrow[c] value which is sRGB encoded.
++ * Arithmetic here is 16-bits to preserve the output
++ * values correctly.
++ */
++ component *= 257*255; /* =65535 */
++ component += (255-alpha)*png_sRGB_table[outrow[c]];
+
+- /* So 'component' is scaled by 255*65535 and is
+- * therefore appropriate for the sRGB-to-linear
+- * conversion table. Clamp to the valid range
+- * as a defensive measure against an internal
+- * libpng bug where the data is sRGB rather than
+- * linear premultiplied.
+- */
+- if (component > 255*65535)
+- component = 255*65535;
+- component = PNG_sRGB_FROM_LINEAR(component);
++ /* Clamp to the valid range to defend against
++ * unforeseen cases where the data might be sRGB
++ * instead of linear premultiplied.
++ * (Belt-and-suspenders for GitHub Issue #764.)
++ */
++ if (component > 255*65535)
++ component = 255*65535;
++
++ /* So 'component' is scaled by 255*65535 and is
++ * therefore appropriate for the sRGB-to-linear
++ * conversion table.
++ */
++ component = PNG_sRGB_FROM_LINEAR(component);
++ }
++ else
++ {
++ /* Compositing was already done on the palette
++ * entries. The data is sRGB premultiplied on black.
++ * Composite with the background in sRGB space.
++ * This is not gamma-correct, but matches what was
++ * done to the palette.
++ */
++ png_uint_32 background = outrow[c];
++ component += ((255-alpha) * background + 127) / 255;
++ if (component > 255)
++ component = 255;
++ }
+ }
+
+ outrow[c] = (png_byte)component;
+diff --git a/pngrtran.c b/pngrtran.c
+index 2f5202255..507d11381 100644
+--- a/pngrtran.c
++++ b/pngrtran.c
+@@ -1760,6 +1760,7 @@ png_init_read_transformations(png_structrp png_ptr)
+ * transformations elsewhere.
+ */
+ png_ptr->transformations &= ~(PNG_COMPOSE | PNG_GAMMA);
++ png_ptr->flags &= ~PNG_FLAG_OPTIMIZE_ALPHA;
+ } /* color_type == PNG_COLOR_TYPE_PALETTE */
+
+ /* if (png_ptr->background_gamma_type!=PNG_BACKGROUND_GAMMA_UNKNOWN) */
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
index 47b76a704b..70685b68e7 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.39.bb
@@ -20,6 +20,8 @@ SRC_URI = "\
file://CVE-2025-64720.patch \
file://CVE-2025-65018-01.patch \
file://CVE-2025-65018-02.patch \
+ file://CVE-2025-66293-01.patch \
+ file://CVE-2025-66293-02.patch \
"
SRC_URI[sha256sum] = "1f4696ce70b4ee5f85f1e1623dc1229b210029fa4b7aee573df3e2ba7b036937"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 3/4] openssh: fix CVE-2025-61984
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 1/4] libxml2: Security fix for CVE-2025-7425 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 2/4] libpng: patch CVE-2025-66293 Steve Sakoman
@ 2025-12-09 21:53 ` Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 4/4] libmicrohttpd: disable experimental code by default Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
ssh in OpenSSH before 10.1 allows control characters in usernames that
originate from certain possibly untrusted sources, potentially leading
to code execution when a ProxyCommand is used. The untrusted sources
are the command line and %-sequence expansion of a configuration file.
Note:
openssh does not support variable expansion until 10.0, so backport
adapts for this.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-61984
Upstream-Status: Backport from https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../openssh/openssh/CVE-2025-61984.patch | 98 +++++++++++++++++++
.../openssh/openssh_8.9p1.bb | 1 +
2 files changed, 99 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch
new file mode 100644
index 0000000000..aee237e507
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2025-61984.patch
@@ -0,0 +1,98 @@
+From 35d5917652106aede47621bb3f64044604164043 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 4 Sep 2025 00:29:09 +0000
+Subject: [PATCH] upstream: Improve rules for %-expansion of username.
+
+Usernames passed on the commandline will no longer be subject to
+% expansion. Some tools invoke ssh with connection information
+(i.e. usernames and host names) supplied from untrusted sources.
+These may contain % expansion sequences which could yield
+unexpected results.
+
+Since openssh-9.6, all usernames have been subject to validity
+checking. This change tightens the validity checks by refusing
+usernames that include control characters (again, these can cause
+surprises when supplied adversarially).
+
+This change also relaxes the validity checks in one small way:
+usernames supplied via the configuration file as literals (i.e.
+include no % expansion characters) are not subject to these
+validity checks. This allows usernames that contain arbitrary
+characters to be used, but only via configuration files. This
+is done on the basis that ssh's configuration is trusted.
+
+Pointed out by David Leadbeater, ok deraadt@
+
+OpenBSD-Commit-ID: e2f0c871fbe664aba30607321575e7c7fc798362
+
+CVE: CVE-2025-61984
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ ssh.c | 11 +++++++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 82ed15f..d4e2040 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -634,6 +634,8 @@ valid_ruser(const char *s)
+ if (*s == '-')
+ return 0;
+ for (i = 0; s[i] != 0; i++) {
++ if (iscntrl((u_char)s[i]))
++ return 0;
+ if (strchr("'`\";&<>|(){}", s[i]) != NULL)
+ return 0;
+ /* Disallow '-' after whitespace */
+@@ -655,6 +657,7 @@ main(int ac, char **av)
+ struct ssh *ssh = NULL;
+ int i, r, opt, exit_status, use_syslog, direct, timeout_ms;
+ int was_addr, config_test = 0, opt_terminated = 0, want_final_pass = 0;
++ int user_on_commandline = 0, user_was_default = 0, user_expanded = 0;
+ char *p, *cp, *line, *argv0, *logfile, *host_arg;
+ char cname[NI_MAXHOST], thishost[NI_MAXHOST];
+ struct stat st;
+@@ -995,8 +998,10 @@ main(int ac, char **av)
+ }
+ break;
+ case 'l':
+- if (options.user == NULL)
++ if (options.user == NULL) {
+ options.user = optarg;
++ user_on_commandline = 1;
++ }
+ break;
+
+ case 'L':
+@@ -1099,6 +1104,7 @@ main(int ac, char **av)
+ if (options.user == NULL) {
+ options.user = tuser;
+ tuser = NULL;
++ user_on_commandline = 1;
+ }
+ free(tuser);
+ if (options.port == -1 && tport != -1)
+@@ -1113,6 +1119,7 @@ main(int ac, char **av)
+ if (options.user == NULL) {
+ options.user = p;
+ p = NULL;
++ user_on_commandline = 1;
+ }
+ *cp++ = '\0';
+ host = xstrdup(cp);
+@@ -1265,8 +1272,10 @@ main(int ac, char **av)
+ if (fill_default_options(&options) != 0)
+ cleanup_exit(255);
+
+- if (options.user == NULL)
++ if (options.user == NULL) {
++ user_was_default = 1;
+ options.user = xstrdup(pw->pw_name);
++ }
+
+ /*
+ * If ProxyJump option specified, then construct a ProxyCommand now.
+--
+2.50.1
+
diff --git a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
index 780ece8999..6ba85712b3 100644
--- a/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_8.9p1.bb
@@ -40,6 +40,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2025-26465.patch \
file://CVE-2025-32728.patch \
file://CVE-2025-61985.patch \
+ file://CVE-2025-61984.patch \
"
SRC_URI[sha256sum] = "fd497654b7ab1686dac672fb83dfb4ba4096e8b5ffcdaccd262380ae58bec5e7"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 4/4] libmicrohttpd: disable experimental code by default
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-12-09 21:53 ` [OE-core][kirkstone 3/4] openssh: fix CVE-2025-61984 Steve Sakoman
@ 2025-12-09 21:53 ` Steve Sakoman
3 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-09 21:53 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Introduce new packageconfig to explicitly avoid compilation of
experimental code. Note that the code was not compiled by default also
before this patch, this now makes it explicit and makes it possible to
check for the flags in cve-check code.
This is less intrusive change than a patch removing the code which was
rejected in patch review.
This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code
is not compiled by default.
Set appropriate CVE status for these CVEs based on new packageconfig.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb b/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb
index ad3c34ab9e..264af6d81a 100644
--- a/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb
+++ b/meta/recipes-support/libmicrohttpd/libmicrohttpd_0.9.76.bb
@@ -22,9 +22,12 @@ PACKAGECONFIG:append:class-target = "\
PACKAGECONFIG[largefile] = "--enable-largefile,--disable-largefile,,"
PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl,"
PACKAGECONFIG[https] = "--enable-https,--disable-https,libgcrypt gnutls,"
+PACKAGECONFIG[experimental] = "--enable-experimental,--disable-experimental,"
do_compile:append() {
sed -i s:-L${STAGING_LIBDIR}::g libmicrohttpd.pc
}
BBCLASSEXTEND = "native nativesdk"
+
+CVE_CHECK_IGNORE += "${@bb.utils.contains('PACKAGECONFIG', 'experimental', '', 'CVE-2025-59777 CVE-2025-62689', d)}"
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [OE-core][kirkstone 0/4] Patch review
@ 2025-12-29 23:03 Steve Sakoman
0 siblings, 0 replies; 14+ messages in thread
From: Steve Sakoman @ 2025-12-29 23:03 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, December 31
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2953
The following changes since commit c15faee8854e85e02693a041d88326f30b24ee92:
cross.bbclass: Propagate dependencies to outhash (2025-12-29 08:40:22 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Jiaying Song (1):
grub: fix CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
Vijay Anusuri (3):
go: Update CVE-2025-58187
go: Fix CVE-2025-61727
go: Fix CVE-2025-61729
.../grub/files/CVE-2025-61661.patch | 40 ++
.../grub/files/CVE-2025-61662.patch | 72 +++
.../grub/files/CVE-2025-61663_61664.patch | 64 +++
meta/recipes-bsp/grub/grub2.inc | 3 +
meta/recipes-devtools/go/go-1.17.13.inc | 5 +-
...025-58187.patch => CVE-2025-58187-1.patch} | 0
.../go/go-1.18/CVE-2025-58187-2.patch | 516 ++++++++++++++++++
.../go/go-1.18/CVE-2025-61727.patch | 229 ++++++++
.../go/go-1.18/CVE-2025-61729.patch | 172 ++++++
9 files changed, 1100 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61661.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61662.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2025-61663_61664.patch
rename meta/recipes-devtools/go/go-1.18/{CVE-2025-58187.patch => CVE-2025-58187-1.patch} (100%)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-58187-2.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61727.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61729.patch
--
2.43.0
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-12-29 23:03 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-09 21:53 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 1/4] libxml2: Security fix for CVE-2025-7425 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 2/4] libpng: patch CVE-2025-66293 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 3/4] openssh: fix CVE-2025-61984 Steve Sakoman
2025-12-09 21:53 ` [OE-core][kirkstone 4/4] libmicrohttpd: disable experimental code by default Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-12-29 23:03 [OE-core][kirkstone 0/4] Patch review Steve Sakoman
2025-10-29 2:54 Steve Sakoman
2025-08-05 16:43 Steve Sakoman
2025-04-15 20:52 Steve Sakoman
2025-03-27 14:43 Steve Sakoman
2025-01-31 14:15 Steve Sakoman
2024-03-07 18:38 Steve Sakoman
2024-02-01 19:37 Steve Sakoman
2023-12-29 16:07 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox