Changelog for libxslt1-1.1.39-150700.146.1.x86_64.rpm :

* Fri May 24 2024 christopheAATTkrop.fr- Add upstream build fix:
* 0001-tests-Fix-build-with-older-libxml2.patch
* Sun May 05 2024 brunopitrusAATThotmail.com- Fix ftbfs with GCC14 (bsc#1220571)
* correct libxslt-random-seed.patch to include time.h unconditionally
* add gcc14-runtest-no-const.patch
* Fri Nov 24 2023 bjorn.lieAATTgmail.com- Update to version 1.1.39:
* Bug fixes: extensions: Don\'t search imports for extension prefixes
* Improvements: - transform: Check maximum depth when processing default templates - build: . Add more missing include . Add missing includes - python: Don\'t set deprecated global - imports: Limit nesting depth - extensions: Report top-level elements in xsltDebugDumpExtensions - Add extern \"C\" { } block to xsltlocale.h
* Portability: - python: Make it compatible with python3.12 - date: . Fix check for localtime_s . Fix check for gmtime_s
* Build systems: - pkg-config files include cflags for static builds - Handle NOCONFIG case when setting locations from CMake target properties - autotools: Make xslt-config executable
* Tests: - tests: Structured error handler now passes a const xmlError - python: Fix tests on MinGW - fuzz: Fix xmlFuzzEntityLoader after recent libxml2 changes
* Tue May 09 2023 david.anesAATTsuse.com- Removed patch 0009-Make-generate-id-deterministic.patch as it\'s already fixed upstream.- Update to version 1.1.38:
* Major changes: - About 40 memory errors in code paths handling malloc failures have been fixed. - While these issues shouldn\'t impact security, this improves robustness under memory pressure. - The result of generate-id() is now deterministic across multiple transformations fixing many issues with reproducible builds. - Most of the test suite has been ported to C.
* Bug fixes: - Fix memory errors in code handling malloc failures - imports: Fix import/include cycle check - xsltlocale: Fix xsltNewLocale on macOS - Make xsl:sort thread-safe - Make generate-id() deterministic
* Improvements - Stop using xmlStringCurrentChar - attributes.h needs to include xsltInternals.h (David Kilzer) - transform: Avoid null deref on documents without root node - numbers: Fix floating point overflows - date: Fix integer overflow in exsltDateFormatDuration - numbers: Fix harmless integer sign change - date: Add more overflow checks to formatting code (David Kilzer) - date: Fix rounding to make Windows tests pass - date: Rewrite duration and seconds formatting - xsltlocale: Make API platform-independent - Also accept application/xslt+xml media type in stylesheet PIs - warnings: Fix strict prototypes warning - xsltEvalUserParams() and xsltQuoteUserParams() are susceptible to integer overflow when iterating through const char
*
* array (David Kilzer) - xslt: Return NULL stylesheet on attribute set errors - xsltproc: Fix unused variable warning - xslt: Remove declaration for old libxml2 - Fix various compiler warnings - Fix compiler warnings in xsltGenerateIdFunction - Disable Python bindings for debugger - Don\'t declare disabled functions - Migrate from PyEval_ to PyObject_
* Tue Aug 30 2022 bjorn.lieAATTgmail.com- Update to version 1.1.37:
* Improvements: + Don\'t use deprecated libxml2 macros + Don\'t mess with xmlDefaultSAXHandler
* Build system: + Require automake-1.16.3 or later + Remove generated files from distribution + Add missing compile definition for static builds to Autotools
* Thu Aug 18 2022 david.anesAATTsuse.com- Update to 1.1.36:
* Removals and deprecations + Remove SVN keyword anchors + Remove CVS and SVN-related code + Remove README.cvs-commits + Remove ChangeLog + Remove xsltwin32config.h
* Improvements + Simplify xsltexports.h and exsltexports.h + Don\'t overlink executables with gcrypt + Fix quadratic behavior with variables and parameters + Remove case labels with XPointer location types + Add configure~ to .gitignore + Stop calling deprecated libxml2 functions
* Portability + Use portable python shebangs (David Seifert) + Remove useless __CYGWIN__ checks + Remove cruft from win32config.h + crypto.c: Silence a compiler warning on Windows (Chun-wei Fan)
* Build system + Add missing compile definition for static builds to CMake + Avoid obsolescent `test -a` constructs (David Seifert) + Only link libxml2 statically in purely static build + Set AC_CONFIG_MACRO_DIR + Allow AM_MAINTAINER_MODE to be disabled + Streamline and fix documentation installation + Don\'t try to recreate COPYING symlink + Remove special configuration for certain maintainers + configure.ac: produce tar.xz only (GNOME policy) (David Seifert) + Detect libm using libtool\'s macros (David Seifert) + configure.ac: disable static libraries by default (David Seifert) + python/Makefile.am: nest python docs in $(docdir) (David Seifert) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE (David Seifert) + configure.ac: remove useless AC_SUBST (David Seifert) + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings (David Seifert) + Change libxml2 Python config + Don\'t check for standard C89 library functions + Don\'t check for standard C89 headers + Remove --with-html-dir option + Also check for glibtoolize in autogen.sh + Rework documentation build system + Remove old website + CMake: Relax check for enabling crypto support on Windows (Chun-wei Fan) + Remove obsolete AC_HEADER_STDC autoconf macro (Vadim Zeitlin) + Remove special configuration for old maintainers
* Test suite, CI + Remove test involving XPointer range-to function + Test recursion in EXSLT dynamic functions + Add CI job for static build
* Documentation + Move tutorial images
* Wed Mar 09 2022 luc14n0AATTopensuse.org- Update to version 1.1.35:
* Security fixes: + [CVE-2021-30560] Use-after-free in xsltApplyTemplates; + A couple of memory leak and a double-free fixes.
* A couple of regression fixes.
* Many bug fixes.
* New xsltproc --huge option, provided by libxml XML_PARSE_HUGE.
* Numerous tests and code and fuzzing fixes and improvements.
* Updated documentation.- The full Libxslt 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.\\ news- Switch libxml2-devel package with its pkgconfig module counterpart (libxml-2.0) to align with CONFIGURE script\'s checks.- Add fdupes build requirement/macro to hard-link duplicate files in the DATADIR inside the buildroot.- Add explicit \'gcc\' build requirement to align with CONFIGURE checks.- Update http://xmlsoft.org URL tag to Libxslt\'s new web home: https://gitlab.gnome.org/GNOME/libxslt.- Update ftp://xmlsoft.org Source tag to Libxslt\'s new download host: https://download.gnome.org.- Drop no longer needed/used libgpg-error-devel. Note that despite \'lgpg-error\' being linked against some libraries, there\'s no automatic generation of run-time requirements on libgpg-error
* symbols our build system. And there\'s no mention of gpg-error in the whole source tarball at all.- Drop no longer needed explicit libtool build requirement and `autoreconf` call in build section since we don\'t touch the build system scripts nor use checked out git trees anymore.- Drop libxslt.keyring source file as the new download host doesn\'t offer GPG signatures.- Drop fixed upstream patches: libxslt-config-fixes.patch (glgo#GNOME/libxslt!3); libxslt-Stop-using-maxParserDepth-XPath-limit.patch; libxslt-Do-not-set-maxDepth-in-XPath-contexts.patch; and Recreate-xsltproc-man-page-with-old-Docbook-styleshe.patch.- Use ldconfig_scriptlets macro for post(un) handling of ldconfig calls.
* Wed Nov 10 2021 pmonrealAATTsuse.com- Add missing library .so files [bsc#1191771]
* Fri Nov 05 2021 andreas.stiegerAATTgmx.de- shared lib packaging policy boo#1191771
* Thu Jun 10 2021 pvorelAATTsuse.cz- Backport upstream xsltproc manpage fix f165525f Recreate xsltproc man page with old Docbook stylesheet URL Recreate-xsltproc-man-page-with-old-Docbook-styleshe.patch
* Mon Jun 07 2021 schwabAATTsuse.de- Don\'t disable testsuite under QEMU
* Wed Jun 02 2021 christopheAATTkrop.fr- Move the Copyright file to %_defaultlicensedir Configure.ac replaces the COPYING file with a symlink.
* Tue Jun 01 2021 pmonrealAATTsuse.com- Fix build with libxml2 2.9.12 that removes maxParserDepth XPath limit- Add upstream patches:
* libxslt-Stop-using-maxParserDepth-XPath-limit.patch
* libxslt-Do-not-set-maxDepth-in-XPath-contexts.patch
* Wed Nov 20 2019 pmonrealgonzalezAATTsuse.com- Update to 1.1.34: Oct 30 2019
* Documentation: - Fix EXSLT web pages, Regenerate web pages - Fix Git link in news.html - Minor documentation fixes after recent changes - Regenerate symbols and API docs - Regenerate EXSLT website
* Portability: - Remove stubs when compiling without debugger or profiler - configure.ac: Invoke PKG_CHECK_MODULES for building shared libraries - configure.ac: Conditionally determine whether xml2-config should pass shared libraries or static libraries - xslt-config.in: Fix broken --prefix=DIR support - libexslt.pc.in: Do not expose private library dependencies unless invoked - libxslt.pc.in: Do not expose private library dependencies unless invoked - Fix -Wformat-overflow warning (GCC 9) - Stop including ansidecl.h - Remove WIN32_EXTRA_
* variables - Build without winsock
* Bug Fixes: - xsl:template without name and match attributes should not be allowed - Make sure that Python tests exit with error code - Improve handling of invalid UTF-8 in format-number - Fix dangling pointer in xsltCopyText - Fix memory leak in pattern compilation error path - Fix uninitialized read with UTF-8 grouping chars - Fix integer overflow in FORMAT_GYEAR - Fix performance regression with xsl:number - Backup XPath context node in xsltInitCtxtKey - Fix unsigned integer overflow in date.c - Fix insertion of xsl:fallback content - Avoid quadratic behavior in xsltSaveResultTo - Fix numbering in non-Latin scripts - Fix uninitialized read of xsl:number token - Fix integer overflow in _exsltDateDayInWeek - Rework xsltAttrVT allocation - Fix check of xsltTestCompMatch return value - Fix security framework bypass - Use xmlNewTextChild in EXSLT dyn:map - Fix float casts in exsltDateDuration - Always set context node before calling XPath iterators - Fix attribute precedence with xsl:use-attribute-sets - Backup context node in exsltFuncFunctionFunction - Initialize ctxt->output before evaluating global vars - Fix memory leak in EXSLT functions error path
* Improvements: - Fix -Wimplicit-fallthrough warnings - Adjust number of API index pages - Make xsltCompileRelativePathPattern non-recursive - Check that crypto:rc4_decrypt produces valid UTF-8 - Avoid recursion in keys.c:skipPredicate - xslt-config.in: Simply handling of $all_flags - xslt-config.in: Add a --dynamic option to --libs - xslt-config.in: Simplify basic library handling - xslt-config.in: Remove unused variable - xslt-config: Simply handling of --cflags - Improve fuzzers - Always reuse XPath context - Compile with -Wextra - Make profiler support optional - Hide unused code when compiling without debugger - Reorganize fuzzing code - Optional operation limit - Improve seed corpus and dictionary - Reuse XPath context when compiling stylesheets - Reuse XPath context in dyn:map - Reuse XPath context in saxon:expression - Add libFuzzer targets - Adjust error message in expected test output - Change bug tracker URL - Change git repo URL - Regenerate NEWS - Fix misleading indentation in security.c
* Cleanups: - Remove empty TODO file - Remove generated file libxsltclass.txt from version control - Rebuild docs- Rebase patch libxslt-config-fixes.patch- Remove patches fixed upstream:
* libxslt-CVE-2019-11068.patch
* libxslt-CVE-2019-13117.patch
* libxslt-CVE-2019-13118.patch
* libxslt-CVE-2019-18197.patch
* Mon Oct 21 2019 pmonrealgonzalezAATTsuse.com- Security fix [bsc#1154609, CVE-2019-18197]
* Fix dangling pointer in xsltCopyText
* Add libxslt-CVE-2019-18197.patch
* Tue Oct 01 2019 tchvatalAATTsuse.com- Drop out lilbxslt-python package as it is just py2 based and upstream yet didn\'t bother to port it to python3. When there is python3 compatible code it should be enabled as multibuild here
* Drop now unused libxslt-1.1.24-linkflags.patch and libxslt-do_not_build_doc_nor_xsltproc.patch
* Tue Jul 02 2019 pmonrealgonzalezAATTsuse.com- Security fix: [bsc#1140101, CVE-2019-13118]
* Fix uninitialized read with UTF-8 grouping chars. Read of uninitialized stack data due to too narrow xsl:number instruction and an invalid character
* Added libxslt-CVE-2019-13118.patch
* Tue Jul 02 2019 pmonrealgonzalezAATTsuse.com- Security fix: [bsc#1140095, CVE-2019-13117]
* Fix uninitialized read of xsl:number token. An xsl number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers
* Added libxslt-CVE-2019-13117.patch
* Thu Apr 11 2019 pmonrealgonzalezAATTsuse.com- Security fix: [bsc#1132160, CVE-2019-11068]
* Bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
* Added libxslt-CVE-2019-11068.patch
* Mon Mar 04 2019 pmonrealgonzalezAATTsuse.com- Update to version 1.1.33
* Portability: - Variables need \'extern\' in static lib on Cygwin - Really declare dllexport/dllimport for Cygwin - Fix callback signatures in Python bindings - Fix transform callback signatures - Fix extension callback signatures - Fix deallocator signatures - Fix XPath callback signatures - Fix hash callback signatures
* Bug Fixes: - Don\'t cache direct evaluation of patterns with variables - Move function result RVTs to context variable - Fix EXSLT functions returning RVTs from outer scopes - Fix handling of RVTs returned from nested EXSLT functions - Fix typos
* Improvements: - Run Travis ASan tests with \"sudo: required\"
* Cleanups: - Remove doc/libxslt-decl.txt - Docs for 1.1.32 release- Cleaned with spec-cleaner
* Wed Nov 08 2017 vcizekAATTsuse.com- Update to version 1.1.32
* fixes xml-config detection regression (boo#1066525)
* Thu Oct 19 2017 pmonrealgonzalezAATTsuse.com- Update to version 1.1.30 [bsc#1063934]
* Documentation: - Misc doc fixes
* Portability: - Look for libxml2 via pkg-config first
* Bug Fixes: - Also fix memory hazards in exsltFuncResultElem - Fix NULL deref in xsltDefaultSortFunction - Fix memory hazards in exsltFuncFunctionFunction - Fix memory leaks in EXSLT error paths - Fix memory leak in str:concat with empty node-set - Fix memory leaks in error paths - Switch to xmlUTF8Strsize in numbers.c - Fix NULL pointer deref in xsltFormatNumberFunction - Fix UTF-8 check in str:padding - Fix xmlStrPrintf argument - Check for overflow in _exsltDateParseGYear - Fix double to int conversion - Check for overflow in exsltDateParseDuration - Change version of xsltMaxVars back to 1.0.24 - Disable xsltCopyTextString optimization for extensions - Create DOCTYPE for HTML version 5 - Make xsl:decimal-format work with namespaces - Remove norm:localTime extension function - Check for integer overflow in xsltAddTextString - Detect infinite recursion when evaluating function arguments - Fix memory leak in xsltElementAvailableFunction - Fix for pattern predicates calling functions - Fix cmd.exe invocations in Makefile.mingw - Don\'t try to install index.sgml - Fix symbols.xml - Fix heap overread in xsltFormatNumberConversion - Fix for non-element nodes - Fix unreachable code in xsltAddChild - Change version number in xsl:version warning - Avoid infinite recursion after failed param evaluation - Stop if potential recursion is detected - Consider built-in templates in apply-imports - Fix precedence with multiple attribute sets - Rework attribute set resolution
* Improvements: - Silence tests a little - Set LIBXML_SRC to absolute path - Add missing #include - Adjust expected error messages in tests - Make xsltDebug more quiet - New-line terminate error message that missed this convention - Use xmlBuffers in EXSLT string functions - Switch to xmlUTF8Strsize in EXSLT string functions - Check for return value of xmlUTF8Strlen - Avoid double/long round trip in FORMAT_ITEM - Separate date and duration structs - Check for overflow in _exsltDateDifference - Clamp seconds field of durations - Change _exsltDateAddDurCalc parameter types - Fix date:difference with time zones - Rework division/remainder arithmetic in date.c - Remove exsltDateCastDateToNumber - Change internal representation of years - Optimize IS_LEAP - Link libraries with libm - Rename xsltCopyTreeInternal to xsltCopyTree - Update linker version script - Add local wildcard to version script - Make some symbols static - Remove redundant NULL check in xsltNumberComp - Fix forwards compatibility for imported stylesheets - Reduce warnings in forwards-compatible mode - Precompute XSLT elements after preprocessing - Fix whitespace in xsltParseStylesheetTop - Consolidate recursion checks - Treat XSLT_STATE_STOPPED same as errors - Make sure that XSLT_STATE_STOPPED isn\'t overwritten - Add comment regarding built-in templates and params - Rewrite memory management of local RVTs - Validate QNames of attribute sets - Add xsl:attribute-set regression tests - Ignore imported stylesheets in xsltApplyAttributeSet- Dropped patches fixed upstream
* libxslt-CVE-2016-4738.patch
* libxslt-1.1.28-CVE-2017-5029.patch
* Mon Sep 11 2017 jengelhAATTinai.de- Fix RPM groups. Drop ineffective --with-pic. Trim conjecture from description.
* Fri Jul 28 2017 mpluskalAATTsuse.com- Add gpg signature- Cleanup spec file with spec-cleaner
* Tue Apr 25 2017 pmonrealgonzalezAATTsuse.com- Fixed CVE-2017-5029 bcs#1035905
* Limit buffer size in xsltAddTextString to INT_MAX- Added patch libxslt-1.1.28-CVE-2017-5029.patch
* Wed Apr 05 2017 pgajdosAATTsuse.com- security update: initialize random generator, CVE-2015-9019 [bsc#934119] + libxslt-random-seed.patch
* Mon Mar 13 2017 pmonrealgonzalezAATTsuse.com- Added patch libxslt-CVE-2016-4738.patch
* Fix heap overread in xsltFormatNumberConversion: An empty decimal-separator could cause a heap overread. This can be exploited to leak a couple of bytes after the buffer that holds the pattern string.
* bsc#1005591 CVE-2016-4738
* Sat Jun 11 2016 tchvatalAATTsuse.com- Update to 1.1.29:
* new release after 4 years with few bugfies all around- Refresh patch 0009-Make-generate-id-deterministic.patch to apply- Remove cve patch that was integrated upstream: libxslt-1.1.28-type_confusion_preprocess_attr.patch- Unpack the manpage as the compression is set by buildbot not always gz
* Fri May 20 2016 kstreitovaAATTsuse.com- add libxslt-1.1.28-type_confusion_preprocess_attr.patch to fix type confusion in preprocessing attributes [bnc#952474], [CVE-2015-7995]
* Thu Apr 09 2015 suseAATTmicrostep-mis.com- fix package with \"soname\" should obsolete libxslt package on suse < 12.2 (SLE11)
* Sun Feb 01 2015 cooloAATTsuse.com- add 0009-Make-generate-id-deterministic.patch from debian\'s reproducible builds project to avoid randomness in generated IDs