Re: Release of libxml2 2.9.13

--===============2890660934967263598==
Content-Type: multipart/alternative; boundary="00000000000063b21b05d8786d85"

--00000000000063b21b05d8786d85
Content-Type: text/plain; charset="UTF-8"

Nick, thank you for shipping this release!

Is there any additional information about CVE-2022-23308 (other than the
commit log) that would help downstream projects triage? Was there a CVSS
score calculated or severity assigned?

On Sun, Feb 20, 2022 at 7:53 AM Nick Wellnhofer via xml <[email protected]>
wrote:

> Version 2.9.13 of libxml2 is available at:
>
>      https://download.gnome.org/sources/libxml2/2.9/
>
> Note that starting with this release, libxml2 tarballs are published on
> download.gnome.org instead of ftp.xmlsoft.org.
>
> ### Security
>
> - [CVE-2022-23308] Use-after-free of ID and IDREF attributes
>    (Thanks to Shinji Sato for the report)
> - Use-after-free in xmlXIncludeCopyRange (David Kilzer)
> - Fix null deref in xmlSchemaGetComponentTargetNs (huangduirong)
> - Fix memory leak in xmlXPathCompNodeTest
> - Fix null pointer deref in xmlStringGetNodeList
> - Fix several memory leaks found by Coverity (David King)
>
> ### Fixed regressions
>
> - Fix regression in RelaxNG pattern matching
> - Properly handle nested documents in xmlFreeNode
> - Fix regression with PEs in external DTD
> - Fix random dropping of characters on dumping ASCII encoded XML (Mohammad
>    Razavi)
> - Revert "Make schema validation fail with multiple top-level elements"
> - Fix regression when parsing invalid HTML tags in push mode
> - Fix regression parsing public IDs literals in HTML
> - Fix buffering in xmlOutputBufferWrite
> - Fix whitespace when serializing empty HTML documents
> - Fix XPath recursion limit
> - Fix regression in xmlNodeDumpOutputInternal
> - Work around lxml API abuse
>
> ### Bug fixes
>
> - Fix xmlSetTreeDoc with entity references
> - Fix double counting of CRLF in comments
> - Make sure to grow input buffer in xmlParseMisc
> - Don't ignore xmllint options after "-"
> - Don't normalize namespace URIs in XPointer xmlns() scheme
> - Fix handling of XSD with empty namespace
> - Also register HTML document nodes
> - Make xmllint return an error if arguments are missing
> - Fix handling of ctxt->base in xmlXPtrEvalXPtrPart
> - Fix xmllint --maxmem
> - Fix htmlReadFd, which was using a mix of xml and html context functions
>    (Finn Barber)
> - Move current position before possible calling of ctxt->sax->characters
>    (Yulin Li)
> - Fix parse failure when 4-byte character in UTF-16 BE is split across a
> chunk
>    (David Kilzer)
> - Patch to forbid epsilon-reduction of final states (Arne Becker)
> - Avoid segfault at exit when using custom memory functions (Mike Dalessio)
>
> ### Tests, code quality, fuzzing
>
> - Remove .travis.yml
> - Make xmlFuzzReadString return a zero size in error case
> - Fix unused function warning in testapi.c
> - Update NewsML DTD in test suite
> - Add more checks for malloc failures in xmllint.c
> - Avoid potential integer overflow in xmlstring.c
> - Run CI tests with UBSan implicit-conversion checks
> - Fix casting of line numbers in SAX2.c
> - Fix integer conversion warnings in hash.c
> - Add explicit casts in runtest.c
> - Fix integer conversion warning in xmlIconvWrapper
> - Add suffix to unsigned constant in xmlmemory.c
> - Add explicit casts in testchar.c
> - Fix integer conversion warnings in xmlstring.c
> - Add explicit cast in xmlURIUnescapeString
> - Remove unused variable in xmlCharEncOutFunc (David King)
>
> ### Build system, portability
>
> - Remove xmlwin32version.h
> - Fix fuzzer test with VPATH build
> - Support custom prefix when installing Python module
> - Remove Makefile.win
> - Remove CVS and SVN-related code
> - Port python 3.x module to Windows and improve distutils (Chun-wei Fan)
> - Correctly install the HTML examples into their subdirectory (Mattia
> Rizzolo)
> - Refactor the settings of $docdir (Mattia Rizzolo)
> - Remove unused configure checks (Ben Boeckel)
> - python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS (Sam James)
> - Fix check for libtool in autogen.sh
> - Use version in configure.ac for CMake (Timothy Lyanguzov)
> - Add CMake alias targets for embedded projects (Markus Rickert)
>
> ### Documentation
>
> - Remove SVN keyword anchors
> - Rework README
> - Remove README.cvs-commits
> - Remove old ChangeLog
> - Update hyperlinks
> - Remove README.docs
> - Remove MAINTAINERS
> - Remove xmltutorial.pdf
> - Upload documentation to GitLab pages
> - Document how to escape XML_CATALOG_FILES
> - Fix libxml2.doap
> - Update URL for libxml++ C++ binding (Kjell Ahlstedt)
> - Generate devhelp2 index file (Emmanuele Bassi)
> - Mention XML_CATALOG_FILES is space-separated (Jan Tojnar)
> - Add documentaiton for xmllint exit code 10 (Rainer Canavan)
> - Fix some validation errors in the FAQ (David King)
> - Add instructions on how to use CMake to compile libxml (Markus Rickert)
>
> Thanks to all contributors!
>
> Nick
>
> _______________________________________________
> xml mailing list, project page  http://xmlsoft.org/
> [email protected]
> https://mail.gnome.org/mailman/listinfo/xml
>

--00000000000063b21b05d8786d85
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Nick, thank you for shipping this release!<div><br></div><=
div>Is there any additional information about CVE-2022-23308 (other than th=
e commit log) that would=C2=A0help downstream projects triage? Was there a =
CVSS score calculated or severity assigned?</div></div><br><div class=3D"gm=
ail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Feb 20, 2022 at 7:=
53 AM Nick Wellnhofer via xml &lt;<a href=3D"mailto:[email protected]">xml@gnom=
e.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:=
1ex">Version 2.9.13 of libxml2 is available at:<br>
<br>
=C2=A0 =C2=A0 =C2=A0<a href=3D"https://download.gnome.org/sources/libxml2/2=
.9/" rel=3D"noreferrer" target=3D"_blank">https://download.gnome.org/source=
s/libxml2/2.9/</a><br>
<br>
Note that starting with this release, libxml2 tarballs are published on <br=
>
<a href=3D"http://download.gnome.org" rel=3D"noreferrer" target=3D"_blank">=
download.gnome.org</a> instead of <a href=3D"http://ftp.xmlsoft.org" rel=3D=
"noreferrer" target=3D"_blank">ftp.xmlsoft.org</a>.<br>
<br>
### Security<br>
<br>
- [CVE-2022-23308] Use-after-free of ID and IDREF attributes<br>
=C2=A0 =C2=A0(Thanks to Shinji Sato for the report)<br>
- Use-after-free in xmlXIncludeCopyRange (David Kilzer)<br>
- Fix null deref in xmlSchemaGetComponentTargetNs (huangduirong)<br>
- Fix memory leak in xmlXPathCompNodeTest<br>
- Fix null pointer deref in xmlStringGetNodeList<br>
- Fix several memory leaks found by Coverity (David King)<br>
<br>
### Fixed regressions<br>
<br>
- Fix regression in RelaxNG pattern matching<br>
- Properly handle nested documents in xmlFreeNode<br>
- Fix regression with PEs in external DTD<br>
- Fix random dropping of characters on dumping ASCII encoded XML (Mohammad<=
br>
=C2=A0 =C2=A0Razavi)<br>
- Revert &quot;Make schema validation fail with multiple top-level elements=
&quot;<br>
- Fix regression when parsing invalid HTML tags in push mode<br>
- Fix regression parsing public IDs literals in HTML<br>
- Fix buffering in xmlOutputBufferWrite<br>
- Fix whitespace when serializing empty HTML documents<br>
- Fix XPath recursion limit<br>
- Fix regression in xmlNodeDumpOutputInternal<br>
- Work around lxml API abuse<br>
<br>
### Bug fixes<br>
<br>
- Fix xmlSetTreeDoc with entity references<br>
- Fix double counting of CRLF in comments<br>
- Make sure to grow input buffer in xmlParseMisc<br>
- Don&#39;t ignore xmllint options after &quot;-&quot;<br>
- Don&#39;t normalize namespace URIs in XPointer xmlns() scheme<br>
- Fix handling of XSD with empty namespace<br>
- Also register HTML document nodes<br>
- Make xmllint return an error if arguments are missing<br>
- Fix handling of ctxt-&gt;base in xmlXPtrEvalXPtrPart<br>
- Fix xmllint --maxmem<br>
- Fix htmlReadFd, which was using a mix of xml and html context functions<b=
r>
=C2=A0 =C2=A0(Finn Barber)<br>
- Move current position before possible calling of ctxt-&gt;sax-&gt;charact=
ers<br>
=C2=A0 =C2=A0(Yulin Li)<br>
- Fix parse failure when 4-byte character in UTF-16 BE is split across a ch=
unk<br>
=C2=A0 =C2=A0(David Kilzer)<br>
- Patch to forbid epsilon-reduction of final states (Arne Becker)<br>
- Avoid segfault at exit when using custom memory functions (Mike Dalessio)=
<br>
<br>
### Tests, code quality, fuzzing<br>
<br>
- Remove .travis.yml<br>
- Make xmlFuzzReadString return a zero size in error case<br>
- Fix unused function warning in testapi.c<br>
- Update NewsML DTD in test suite<br>
- Add more checks for malloc failures in xmllint.c<br>
- Avoid potential integer overflow in xmlstring.c<br>
- Run CI tests with UBSan implicit-conversion checks<br>
- Fix casting of line numbers in SAX2.c<br>
- Fix integer conversion warnings in hash.c<br>
- Add explicit casts in runtest.c<br>
- Fix integer conversion warning in xmlIconvWrapper<br>
- Add suffix to unsigned constant in xmlmemory.c<br>
- Add explicit casts in testchar.c<br>
- Fix integer conversion warnings in xmlstring.c<br>
- Add explicit cast in xmlURIUnescapeString<br>
- Remove unused variable in xmlCharEncOutFunc (David King)<br>
<br>
### Build system, portability<br>
<br>
- Remove xmlwin32version.h<br>
- Fix fuzzer test with VPATH build<br>
- Support custom prefix when installing Python module<br>
- Remove Makefile.win<br>
- Remove CVS and SVN-related code<br>
- Port python 3.x module to Windows and improve distutils (Chun-wei Fan)<br=
>
- Correctly install the HTML examples into their subdirectory (Mattia Rizzo=
lo)<br>
- Refactor the settings of $docdir (Mattia Rizzolo)<br>
- Remove unused configure checks (Ben Boeckel)<br>
- python/Makefile.am: use *_LIBADD, not *_LDFLAGS for LIBS (Sam James)<br>
- Fix check for libtool in autogen.sh<br>
- Use version in <a href=3D"http://configure.ac" rel=3D"noreferrer" target=
=3D"_blank">configure.ac</a> for CMake (Timothy Lyanguzov)<br>
- Add CMake alias targets for embedded projects (Markus Rickert)<br>
<br>
### Documentation<br>
<br>
- Remove SVN keyword anchors<br>
- Rework README<br>
- Remove README.cvs-commits<br>
- Remove old ChangeLog<br>
- Update hyperlinks<br>
- Remove README.docs<br>
- Remove MAINTAINERS<br>
- Remove xmltutorial.pdf<br>
- Upload documentation to GitLab pages<br>
- Document how to escape XML_CATALOG_FILES<br>
- Fix libxml2.doap<br>
- Update URL for libxml++ C++ binding (Kjell Ahlstedt)<br>
- Generate devhelp2 index file (Emmanuele Bassi)<br>
- Mention XML_CATALOG_FILES is space-separated (Jan Tojnar)<br>
- Add documentaiton for xmllint exit code 10 (Rainer Canavan)<br>
- Fix some validation errors in the FAQ (David King)<br>
- Add instructions on how to use CMake to compile libxml (Markus Rickert)<b=
r>
<br>
Thanks to all contributors!<br>
<br>
Nick<br>
<br>
_______________________________________________<br>
xml mailing list, project page=C2=A0 <a href=3D"http://xmlsoft.org/" rel=3D=
"noreferrer" target=3D"_blank">http://xmlsoft.org/</a><br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"https://mail.gnome.org/mailman/listinfo/xml" rel=3D"noreferrer" =
target=3D"_blank">https://mail.gnome.org/mailman/listinfo/xml</a><br>
</blockquote></div>

--00000000000063b21b05d8786d85--

--===============2890660934967263598==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
xml mailing list, project page  http://xmlsoft.org/
[email protected]
https://mail.gnome.org/mailman/listinfo/xml

--===============2890660934967263598==--