| Message ID | 20261104142512.1562219-1-joaomarcos.costa@bootlin.com |
|---|---|
| State | New |
| Headers | show |
| Series | [scarthgap] expat: fix CVE-2026-117610 | expand |
On Wed Nov 4, 2026 at 3:25 PM CET, Joao Marcos Costa via openembedded-core wrote: > This vulnerability, marked as High [1], was fixed upstream [2] since > 2.10.0. > > Backport the fix to expat v2.8.3. > > This backport is actually partial. PR#1444 adds a second commit providing a > new test case, but the code uses helper functions not yet > defined/available. A few other commits would also need to be backported so > that the test compiles at v2.8.3. > > [1] https://nvd.nist.gov/vuln/detail/cve-2026-117610 > [2] https://github.com/libexpat/libexpat/pull/1444 > > Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com> > --- > .../expat/expat/CVE-2026-117610.patch | 30 +++++++++++++++++++ > meta/recipes-core/expat/expat_2.8.3.bb | 1 + > 2 files changed, 31 insertions(+) > create mode 100644 meta/recipes-core/expat/expat/CVE-2026-117610.patch Hello, You just sent "[scarthgap][PATCH] expat: fix CVE-2026-118370" which conflict with this one. Even if I have tooling in place to handle this kind of conflict, I'd rather you send conflicting patches as a series. No need of a v2 just for that but something for future series. Thanks!
Hello, Yoan On 11/4/26 4:08 PM, Yoann Congal wrote: > On Wed Nov 4, 2026 at 3:25 PM CET, Joao Marcos Costa via openembedded-core wrote: >> This vulnerability, marked as High [1], was fixed upstream [2] since >> 2.10.0. >> >> Backport the fix to expat v2.8.3. >> >> This backport is actually partial. PR#1444 adds a second commit providing a >> new test case, but the code uses helper functions not yet >> defined/available. A few other commits would also need to be backported so >> that the test compiles at v2.8.3. >> >> [1] https://nvd.nist.gov/vuln/detail/cve-2026-117610 >> [2] https://github.com/libexpat/libexpat/pull/1444 >> >> Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com> >> --- >> .../expat/expat/CVE-2026-117610.patch | 30 +++++++++++++++++++ >> meta/recipes-core/expat/expat_2.8.3.bb | 1 + >> 2 files changed, 31 insertions(+) >> create mode 100644 meta/recipes-core/expat/expat/CVE-2026-117610.patch > > Hello, > > You just sent "[scarthgap][PATCH] expat: fix CVE-2026-118370" which > conflict with this one. Even if I have tooling in place to handle this > kind of conflict, I'd rather you send conflicting patches as a series. > > No need of a v2 just for that but something for future series. > > Thanks! I considered the series, but for some reason I thought these orthogonal fixes would be easier to review if sent separately. My bad!
diff --git a/meta/recipes-core/expat/expat/CVE-2026-117610.patch b/meta/recipes-core/expat/expat/CVE-2026-117610.patch new file mode 100644 index 0000000000..5843b4ac85 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-117610.patch @@ -0,0 +1,30 @@ +From 731159c29d2df0f98ba3a4c61e4bf5d0075acb63 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping <sebastian@pipping.org> +Date: Mon, 26 Oct 2026 17:39:32 +0100 +Subject: [PATCH] lib: Fix initial non-final empty subparser call with a + handler + +CVE: CVE-2026-117610 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1444/commits/bfc28346fa3efeb8ca56c17437d24a7344e5feab] +Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com> + +--- + lib/xmlparse.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index cb8839be..75c3a806 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -3227,6 +3227,11 @@ externalEntityInitProcessor2(XML_Parser parser, const char *start, + } + parser->m_eventPtr = start; + return XML_ERROR_PARTIAL_CHAR; ++ case XML_TOK_NONE: ++ if (! parser->m_parsingStatus.finalBuffer) { ++ *endPtr = start; ++ } ++ return XML_ERROR_NONE; + } + parser->m_processor = externalEntityInitProcessor3; + return externalEntityInitProcessor3(parser, start, end, endPtr); diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 6d08a3fd94..1e7e4e0e5d 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -18,6 +18,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-76957-02.patch \ file://CVE-2026-93990-01.patch \ file://CVE-2026-93990-02.patch \ + file://CVE-2026-117610.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
This vulnerability, marked as High [1], was fixed upstream [2] since 2.10.0. Backport the fix to expat v2.8.3. This backport is actually partial. PR#1444 adds a second commit providing a new test case, but the code uses helper functions not yet defined/available. A few other commits would also need to be backported so that the test compiles at v2.8.3. [1] https://nvd.nist.gov/vuln/detail/cve-2026-117610 [2] https://github.com/libexpat/libexpat/pull/1444 Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com> --- .../expat/expat/CVE-2026-117610.patch | 30 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-117610.patch