[scarthgap,05/10] libxml2: ignore CVE-2025-8732

Message ID	348ce728af1cea4f909de5c3597801b5612719e4.1755633925.git.steve@sakoman.com
State	New
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.175, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 05/10] libxml2: ignore CVE-2025-8732 Date: Tue, 19 Aug 2025 13:07:48 -0700 Message-ID: <348ce728af1cea4f909de5c3597801b5612719e4.1755633925.git.steve@sakoman.com> In-Reply-To: <cover.1755633925.git.steve@sakoman.com> References: <cover.1755633925.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/10] cve-check: Add missing call to exit_if_errors \| expand [scarthgap,01/10] cve-check: Add missing call to exit_if_errors [scarthgap,02/10] dropbear: patch CVE-2025-47203 [scarthgap,03/10] xz: ignore CVE-2024-47611 [scarthgap,04/10] glib-2.0: ignore CVE-2025-4056 [scarthgap,05/10] libxml2: ignore CVE-2025-8732 [scarthgap,06/10] e2fsprogs: Fix build failure with gcc 15 [scarthgap,07/10] parted: Fix build with GCC 15 [scarthgap,08/10] cairo: fix build with gcc-15 on host [scarthgap,09/10] bash: Stick to C17 std [scarthgap,10/10] bash: use -std=gnu17 also for native CFLAGS

Message ID

348ce728af1cea4f909de5c3597801b5612719e4.1755633925.git.steve@sakoman.com

State

New

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 05/10] libxml2: ignore CVE-2025-8732
Date: Tue, 19 Aug 2025 13:07:48 -0700
Message-ID: 
 <348ce728af1cea4f909de5c3597801b5612719e4.1755633925.git.steve@sakoman.com>
In-Reply-To: <cover.1755633925.git.steve@sakoman.com>
References: <cover.1755633925.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/10] cve-check: Add missing call to exit_if_errors | expand

Commit Message

Steve Sakoman Aug. 19, 2025, 8:07 p.m. UTC

From: Daniel Turull <daniel.turull@ericsson.com>

The code maintainer disputes the CVE as the issue can only be triggered with
untrusted SGML catalogs and it makes absolutely no sense to use untrusted
catalogs.

The issue triggers a crash if an invalid file is provided.
Source: https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 078988286a..a155c3708e 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -32,6 +32,10 @@  SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be47223
 # Disputed as a security issue, but fixed in d39f780
 CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail"
 
+# Disputed as a security issue, if attempts to process an invalid file, it fails
+# https://gitlab.gnome.org/GNOME/libxml2/-/issues/958
+CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided.  https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"
+
 BINCONFIG = "${bindir}/xml2-config"
 
 PACKAGECONFIG ??= "python \

[scarthgap,05/10] libxml2: ignore CVE-2025-8732

Commit Message

Patch