[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES
Thomas De Schampheleire
patrickdepinguin at gmail.com
Wed Feb 19 09:11:51 UTC 2020
El mié., 19 feb. 2020 a las 0:37, Thomas Petazzoni
(<thomas.petazzoni at bootlin.com>) escribió:
>
> The libxml2 package has two patches that fix the two CVEs affecting
> libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure
> these CVEs are no longer reported by pkg-stats.
>
> Cc: Titouan Christophe <titouan.christophe at railnova.eu>
> Cc: Thomas De Schampheleire <thomas.de_schampheleire at nokia.com>
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni at bootlin.com>
> ---
> package/libxml2/libxml2.mk | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/package/libxml2/libxml2.mk b/package/libxml2/libxml2.mk
> index f6cf084b2b..ea6a8c1f6d 100644
> --- a/package/libxml2/libxml2.mk
> +++ b/package/libxml2/libxml2.mk
> @@ -9,6 +9,10 @@ LIBXML2_SITE = http://xmlsoft.org/sources
> LIBXML2_INSTALL_STAGING = YES
> LIBXML2_LICENSE = MIT
> LIBXML2_LICENSE_FILES = COPYING
> +# 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> +LIBXML2_IGNORE_CVES += CVE-2020-7595
> +# 0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
> +LIBXML2_IGNORE_CVES += CVE-2019-20388
> LIBXML2_CONFIG_SCRIPTS = xml2-config
>
> # relocation truncated to fit: R_68K_GOT16O
> --
Thanks, I was just going to make this change after Peter's mail :-)
What is the update frequency of http://autobuild.buildroot.org/stats/ ?
/Thomas
More information about the buildroot
mailing list