libxml2-2.13.6

[Douglas R. Reno]

New point version

Release notes
Security

    [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
    [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd
    pattern: Fix compilation of explicit child axis

Regressions

    xmllint: Support compressed input from stdin
    uri: Fix handling of Windows drive letters
    reader: Fix return value of xmlTextReaderReadString again
    SAX2: Fix xmlSAX2ResolveEntity if systemId is NULL

Portability

    dict: Handle ENOSYS from getentropy gracefully
    Fix compilation with uclibc (Dario Binacchi)
    python: Declare init func with PyMODINIT_FUNC
    tests: Fix sanitizer version check on old Apple clang
    cmake: Work around broken sys/random.h in old macOS SDKs

Build

    autotools: Set AC_CONFIG_AUX_DIR
    cmake: Always build Python module as shared library
    cmake: add missing Bcrypt link on Windows (Saleem Abdulrasool)
    cmake: Fix compatibility in package version file

[Douglas R. Reno]

CVE-2025-24928's impact can be quite significant in some cases. From the upstream bug report:

"xmlSnprintfElements is only used to report DTD validation errors. But if such an error occurs, the bug allows to overwrite roughly 5,000 bytes of stack memory with an UTF-8 encoded XML NCName chosen by the attacker."

[Xi Ruoyao]

I suppose we should create a security patch for 12.3.

[Douglas R. Reno]

I'm not really sure if we can implement a patch like that during freeze unfortunately, just due to the sheer amount of packages that use libxml2.

[Douglas R. Reno]

MITRE has rated it as 7.8/10 though, with Red Hat marking it as "Important" which is quite rare.

[Xi Ruoyao]

The patches won't affect the headers and the exported symbols of the libraries, thus we don't need to rebuild everything. We can just do some smoke tests to show the downstream packages still work.

[Douglas R. Reno]

CVE-2024-56171 has been updated to 7.8/10 and has now been confirmed to be used for remote code execution when processing XML documents.

"pattern: Fix compilation of explicit child axis" has been assigned CVE-2025-27113 and is now known to affect the XML::LibXML perl module and the xmllint utility, though that thankfully just allows for a crash.

[Xi Ruoyao]

Promote the security fixes for 12.3 following the decision to make another tagging round.

[Douglas R. Reno]

Fixed at 40da065e3e8690d0491ca60ed9ebb64a3183fcb4

Security advisory incoming shortly

[Douglas R. Reno]

SA-12.2-095 issued