46 lines
1.3 KiB
Diff
46 lines
1.3 KiB
Diff
|
Fix CVE-2017-7375:
|
||
|
|
|
||
|
|
https://bugzilla.gnome.org/show_bug.cgi?id=780691 (not yet public)
|
||
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375
|
||
|
|
https://security-tracker.debian.org/tracker/CVE-2017-7375
|
||
|
|
|
||
|
|
Patch copied from upstream source repository:
|
||
|
|
|
||
|
|
https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e
|
||
|
|
|
||
|
|
From 90ccb58242866b0ba3edbef8fe44214a101c2b3e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Neel Mehta <nmehta@google.com>
|
||
|
|
Date: Fri, 7 Apr 2017 17:43:02 +0200
|
||
|
|
Subject: [PATCH] Prevent unwanted external entity reference
|
||
|
|
|
||
|
|
For https://bugzilla.gnome.org/show_bug.cgi?id=780691
|
||
|
|
|
||
|
|
* parser.c: add a specific check to avoid PE reference
|
||
|
|
---
|
||
|
|
parser.c | 9 +++++++++
|
||
|
|
1 file changed, 9 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/parser.c b/parser.c
|
||
|
|
index 609a2703..c2c812de 100644
|
||
|
|
--- a/parser.c
|
||
|
|
+++ b/parser.c
|
||
|
|
@@ -8123,6 +8123,15 @@ xmlParsePEReference(xmlParserCtxtPtr ctxt)
|
||
|
|
if (xmlPushInput(ctxt, input) < 0)
|
||
|
|
return;
|
||
|
|
} else {
|
||
|
|
+ if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) &&
|
||
|
|
+ ((ctxt->options & XML_PARSE_NOENT) == 0) &&
|
||
|
|
+ ((ctxt->options & XML_PARSE_DTDVALID) == 0) &&
|
||
|
|
+ ((ctxt->options & XML_PARSE_DTDLOAD) == 0) &&
|
||
|
|
+ ((ctxt->options & XML_PARSE_DTDATTR) == 0) &&
|
||
|
|
+ (ctxt->replaceEntities == 0) &&
|
||
|
|
+ (ctxt->validate == 0))
|
||
|
|
+ return;
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* TODO !!!
|
||
|
|
* handle the extra spaces added before and after
|
||
|
|
--
|
||
|
|
2.14.1
|
||
|
|
|