Changelog for libxml2-doc-2.12.9-lp154.qubes.9.10.noarch.rpm :

* Thu Jul 25 2024 Bjørn Lie - Update to version 2.12.9: + Security: (CVE-2024-40896) Fix XXE protection in downstream code. + Improvements: Undeprecate xmlKeepBlanksDefault.
* Wed Jun 12 2024 Dominique Leuenberger - Update to version 2.12.8: + parser: Fix performance regression when parsing namespaces.
* Tue May 14 2024 Dominique Leuenberger - Update to version 2.12.7: + Fix buffer overread with `xmllint --htmlout` (CVE-2024-34459, bsc#1224282). + xmllint: Fix --pedantic option. + save: Handle invalid parent pointers in xhtmlNodeDumpOutput.
* Wed Apr 17 2024 Christoph G - Update to version 2.12.6
* Regressions - parser: Fix detection of duplicate attributes in XML namespace - xmlreader: Fix xmlTextReaderConstEncoding - html: Fix htmlCreatePushParserCtxt with encoding - xmllint: Return error code if XPath returns empty nodeset- Update to version 2.12.5
* Security - [CVE-2024-25062] xmlreader: Don\'t expand XIncludes when backtracking
* Regressions - parser: Fix crash in xmlParseInNodeContext with HTML documents- Update to version 2.12.4
* Regressions - parser: Fix regression parsing standalone declarations - autotools: Readd --with-xptr-locs configuration option - parser: Fix build --without-output - parser: Don\'t grow or shrink pull parser memory buffers - io: Fix memory lifetime issue with input buffers- Update to version 2.12.3
* Regressions - parser: Fix namespaces redefined from default attributes
* Build fixes - include: Rename XML_EMPTY helper macro - include: Move declaration of xmlInitGlobals - include: Add missing includes - include: Move globals from xmlsave.h to parser.h - include: Readd circular dependency between tree.h and parser.h- Drop libxml2-CVE-2024-25062.patch as it is part of upstream
* Sat Feb 10 2024 David Anes - Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader
* Added libxml2-CVE-2024-25062.patch
* Tue Dec 05 2023 Bjørn Lie - Update to version 2.12.2:
* Regressions: - parser: . Fix invalid free in xmlParseBalancedChunkMemoryRecover . Make CRLF increment line number - globals: Disable TLS in static Windows builds - html: Reenable buggy detection of XML declarations - tree: Fix regression when copying DTDs
* Build fixes - build: Disable compiler TLS by default - cmake: Update config.h.cmake.in - tests: Fix tests --with-valid --without-xinclude
* Fri Nov 24 2023 Bjørn Lie - Update to verson 2.12.1:
* Regressions: - hash: Fix deletion of entries during scan - parser: Only enable SAX2 if there are SAX2 element handlers
* Build fixes: - autotools: Stop checking for snprintf - dict: Fix \'__thread\' before \'static\' - fix: pthread weak references in globals.c - tests: Fix build with older MSVC
* Fri Nov 17 2023 David Anes - Bring back a patch that was mistakenly removed in the last update.
* Readded libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
* Thu Nov 16 2023 David Anes - Removed patches (already in upstream):
* libxml2-CVE-2023-39615.patch
* libxml2-CVE-2023-45322.patch
* libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
* python312.patch- Update to 2.12.0:
* Major changes: - Most of the known issues leading to quadratic behavior in the XML parser were fixed. Internal hash tables were rewritten to reduce memory consumption. - Starting with this release, it should be enough to add the - -with-legacy configuration option to provide maximum ABI compatibility. - libxml2 will now store global variables in thread-local storage if supported by the compiler. This avoids allocating the data lazily which can result in a fatal error condition. - A new API function xmlCheckThreadLocalStorage was added so the allocation can be checked earlier if compiler TLS is not supported. - To prepare for future improvements, some API functions now expect or return a const xmlError struct. - Several cyclic dependencies in public header files were fixed. - Refactoring of the encoding code has been mostly completed. Calling xmlSwitchEncoding from client code is now fully supported, for example to override the encoding for the push parser. - When parsing data from memory, libxml2 will now stream data chunk by chunk instead of copying the whole buffer (possibly twice with encodings), reducing peak memory consumption considerably. - A new API function xmlCtxtSetMaxAmplification was added to allow parsing of files that would otherwise trigger the billion laughs protection. - Several bugs in the regex determinism checks were fixed. Invalid XML Schemas which previous versions erroneously accepted will now be rejected.
* Deprecations - globals: Deprecate xmlLastError - parser: Deprecate global parser options - win32: Deprecate old Windows build system
* Bug fixes - parser: Stop switching to ISO-8859-1 on encoding errors - parser: Support encoded external PEs in entity values - string: Fix UTF-8 validation in xmlGetUTF8Char - SAX2: Allow multiple top-level elements - parser: Update line number after coalescing text nodes - parser: Check for truncated multi-byte sequences
* See the full changelog here: - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.0
* Thu Nov 16 2023 Bjørn Lie - Update to version 2.11.6:
* Regressions: - threads: Fix --with-thread-alloc - xinclude: Fix ‘last’ pointer in xmlXIncludeCopyNode
* Bug fixes: parser: Fix potential use-after-free in xmlParseCharDataInternal
* Mon Nov 13 2023 David Anes - Security fix: CVE-2023-45322 (bsc#1216129)
* use-after-free in xmlUnlinkNode() in tree.c
* Added file libxml2-CVE-2023-45322.patch
* Mon Oct 23 2023 Daniel Garcia - Add python312.patch to make it compatible with python 3.12 https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/226- Use pyproject_wheel and pyproject_install macros instead of python_build, python_install
* Mon Sep 04 2023 David Anes - Security fix: CVE-2023-39615 (bsc#1214768)
* crafted xml can cause global buffer overflow
* Added file libxml2-CVE-2023-39615.patch
* Wed Aug 09 2023 Bjørn Lie - Update to version 2.11.5: + Regressions: - parser: Make xmlSwitchEncoding always skip the BOM - autotools: Improve iconv check + Bug fixes: - valid: Fix c1->parent pointer in xmlCopyDocElementContent - encoding: Always call ucnv_convertEx with flush set to false + Portability: autotools: fix Python module file ext for cygwin/msys2 + Tests: runtest: Fix compilation without LIBXML_HTML_ENABLED
* Fri May 19 2023 Bjørn Lie - Update to version 2.11.4: + Fixes a serious regression: parser: Fix regression when push parsing UTF-8 sequences.
* Thu May 11 2023 Bjørn Lie - Update to version 2.11.3: + xinclude: Fix false positives in inclusion loop detection. + autotools: Fix ICU detection. + parser: Fix \"huge input lookup\" error with push parser. + xpath: Fix build without LIBXML_XPATH_ENABLED. + hash: Fix possible startup crash with old libxslt versions. + autoconf: fix iconv library paths.
* Fri May 05 2023 Bjørn Lie - Update to version 2.11.2: + Fix regressions: - threads: Fix startup crash with weak symbol hack - win32: Don’t depend on removed .def file - schemas: Fix memory leak in xmlSchemaValidateStream
* Wed May 03 2023 David Anes - Rebased patches:
* libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
* libxml2-python3-unicode-errors.patch- Update to 2.11.1:
* Fixes build and ABI issues. - cmake: Fix va_copy detection (Luca Niccoli) - libxml.m4: Fix quoting - Link with --undefined-version - libxml2.syms: Revert removal of version information- Update to 2.11.0:
* Major changes - Protection against entity expansion attacks, also known as \"billion laughs\" has been greatly improved. Malicious files should be detected reliably now and false positives should be reduced. It is possible though that large documents which make heavy use of entities are rejected now. - This release finally fixes symbol visibility on UNIX systems. Internal symbols will now be hidden. While these symbols were never declared in public headers, it was still possible to declare them manually. Now this won\'t work. - All symbol information has been removed from the ELF version script to fix link errors with --no-undefined-version. The version nodes are kept so it should still be possible to run binaries linked against older versions. - About 90 memory errors in code paths handling malloc failures have been fixed. While these issues shouldn\'t impact security, this improves robustness under memory pressure. - The XInclude engine has been reworked to properly support nested includes. - Several cases of quadratic behavior in the XML push parser have been fixed. - Refactoring has begun on some buffering and encoding code with the goal of simplifying this part of the code base and improving error reporting.
* Other highlights: - Consolidated private header files. - Major rework of the autoconf build. - Deprecated several outdated and internal functions.
* Security - Fix use-after-free in xmlParseContentInternal() (David Kilzer) - xmllint: Fix use-after-free with --maxmem - parser: Fix OOB read when formatting error message - entities: Rework entity amplification checks
* See the full changelog at https://discourse.gnome.org/t/libxml2-2-11-0-released/15123
* Fri Apr 21 2023 David Anes - Remove unneeded dependency (bsc#1209918).
* Tue Apr 11 2023 Bjørn Lie - Update to version 2.10.4: + Security: - [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings isn’t deterministic - [CVE-2023-28484, bsc#1210411] Fix null deref in xmlSchemaFixupComplexType - schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK + Regressions: - SAX2: Ignore namespaces in HTML documents - io: Fix “buffer full” error with certain buffer sizes
* Wed Feb 01 2023 Dirk Müller - remove zlib-devel, pkgconfig(zlib) is sufficient
* Mon Oct 31 2022 David Anes - Add W3C conformance tests to the testsuite (bsc#1204585):
* Added file xmlts20080827.tar.gz
* Fri Oct 14 2022 Bjørn Lie - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION- Rebase patches with quilt.
* Thu Sep 01 2022 Pedro Monreal - Build for now with --with-legacy to enable APIs that have been deprecated recently. (bsc#1202965)
* Tue Aug 30 2022 Bjørn Lie - Update to version 2.10.2:
* Improvements: + Remove set-but-unused variable in xmlXPathScanName + Silence -Warray-bounds warning
* Build system + build: require automake-1.16.3 or later + Remove generated files from distribution
* Test suite: Don\'t create missing.xml when running testapi- Add configure --with-python=%{__python3} inbefore python build, as upstream no longer ships pre-grenerated files.- Use sed to fix env-script-interpreter in documentation example.- Pass with-ftp to configure, build ftp support.
* Thu Aug 25 2022 Bjørn Lie - Update to version 2.10.1:
* Regressions: Fix xmlCtxtReadDoc with encoding
* Bug fixes: Fix HTML parser with threads and --without-legacy
* Build system: + Fix build with Python 3.10 + cmake: Disable version script on macOS + Remove Makefile rule to build testapi.c
* Documentation: + Switch back to HTML output for API documentation + Port doc/examples/index.py to Python 3 + Fix order of exports in libxml2-api.xml + Remove libxml2-refs.xml
* Thu Aug 18 2022 David Anes - Update to 2.10.0:
* Security + [CVE-2022-2309] Reset nsNr in xmlCtxtReset + Reserve byte for NUL terminator and report errors consistently in xmlBuf and xmlBuffer + Fix missing NUL terminators in xmlBuf and xmlBuffer functions + Fix integer overflow in xmlBufferDump() + xmlBufAvail() should return length without including a byte for NUL terminator + Fix ownership of xmlNodePtr & xmlAttrPtr fields in xmlSetTreeDoc() + Use xmlNewDocText in xmlXIncludeCopyRange + Fix use-after-free bugs when calling xmlTextReaderClose() before xmlFreeTextReader() on post-validating parser + Use UPDATE_COMPAT() consistently in buf.c + fix: xmlXPathParserContext could be double-delete in OOM case.
* Removals and deprecations + Disable XPointer location support by default + Remove outdated xml2Conf.sh + Deprecate module init and cleanup functions + Remove obsolete XML Software Autoupdate (XSA) file + Remove DOCBparser + Remove obsolete Python test framework + Remove broken VxWorks support + Remove broken Mac OS 9 support + Remove broken bakefile support + Remove broken Visual Studio 2010 support + Remove broken Windows CE support + Deprecate IDREF-related functions in valid.h + Deprecate legacy functions + Disable legacy support by default + Deprecate all functions in nanoftp.h + Disable FTP support by default + Add XML_DEPRECATED macro + Remove elfgcchack.h
* Regressions + Skip incorrectly opened HTML comments + Restore behavior of htmlDocContentDumpFormatOutput()
* Bug fixes + Fix memory leak with invalid XSD + Make XPath depth check work with recursive invocations + Fix memory leak in xmlLoadEntityContent error path + Avoid double-free if malloc fails in inputPush + Properly fold whitespace around the QName value when validating an XSD schema. + Add whitespace folding for some atomic data types that it\'s missing on. + Don\'t add IDs containing unexpanded entity references
* Improvements + Avoid calling xmlSetTreeDoc + Simplify xmlFreeNode + Don\'t reset nsDef when changing node content + Fix unintended fall-through in xmlNodeAddContentLen + Remove unused xmlBuf functions + Implement xpath1() XPointer scheme + Add configuration flag for XPointer locations support + Fix compiler warnings in Python code + Mark more static data as `const` + Make xmlStaticCopyNode non-recursive + Clean up encoding switching code + Simplify recursive pthread mutex + Use non-recursive mutex in dict.c + Fix parser progress checks + Avoid arithmetic on freed pointers + Improve buffer allocation scheme + Remove unneeded #includes + Add support for some non-standard escapes in regular expressions. + htmlParseComment: handle abruptly-closed comments + Add let variable tag support + Add value-of tag support + Remove useless call to xmlRelaxNGCleanupTypes + Don\'t include ICU headers in public headers + Update `xmlStrlen()` to use POSIX / ISO C `strlen()` + Fix unused variable warnings with disabled features + Only warn on invalid redeclarations of predefined entities + Remove unneeded code in xmlreader.c + Rework validation context flags
* Portability + Use NAN/INFINITY if available to init XPath NaN/Inf + Fix Python tests on macOS + Fix xmlCleanupThreads on Windows + Fix reinitialization of library on Windows + Don\'t mix declarations and code in runtest.c + Use portable python shebangs + Use critical sections as mutex on Windows + Don\'t set HAVE_WIN32_THREADS in win32config.h + Use stdint.h with newer MSVC + Remove cruft from win32config.h + Remove isinf/isnan emulation in win32config.h + Always fopen files with \"rb\" + Remove __DJGPP__ checks + Remove useless __CYGWIN__ checks
* Build system + Don\'t autogenerate doc/examples/Makefile.am + cmake: Install libxml.m4 on UNIX-like platforms + cmake: Use symbol versioning on UNIX-like platforms + Port genUnicode.py to Python 3 + Port gentest.py to Python 3 + cmake: Fix build without thread support + cmake: Install documentation in CMAKE_INSTALL_DOCDIR + cmake: Remove non needed files in docs dir + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set + Move local Autoconf macros into m4 directory + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD + Update libxml-2.0-uninstalled.pc.in + Remove LIBS from XML_PRIVATE_LIBS + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS + Don\'t overlink executables + cmake: Adjust paths for UNIX or UNIX-like target systems + build: Make use of variables in libxml\'s pkg-config file + Avoid obsolescent `test -a` constructs + Move AM_MAINTAINER_MODE to AM section + configure.ac: make AM_SILENT_RULES([yes]) unconditional + Streamline documentation installation + Don\'t try to recreate COPYING symlink + Detect libm using libtool\'s macros + configure.ac: disable static libraries by default + python/Makefile.am: nest python docs in $(docdir) + python/Makefile.am: rely on global AM_INIT_AUTOMAKE + Makefile.am: install examples more idiomatically + configure.ac: remove useless AC_SUBST + Respect `--sysconfdir` in source files + Ignore configure backup file created by recent autoreconf too + Only install
*.html and
*.c example files + Remove --with-html-dir option + Rework documentation build system + Remove old website + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings + Update genChRanges.py + Update build_glob.py + Remove ICONV_CONST test + Remove obsolete AC_HEADER checks + Don\'t check for standard C89 library functions + Don\'t check for standard C89 headers + Remove special configuration for certain maintainers
* Test suite, CI + Disable network in API tests + testapi: remove leading slash from \"/missing.xml\" + Build Autotools CI tests out of source tree (VPATH) + Add --with-minimum build to CI tests + Fix warnings when testing --with-minimum build + cmake: Run all tests when threads are disabled + Also build CI tests with -Werror + Move doc/examples tests to new test suite + Simplify \'make check\' targets + Fix schemas and relaxng tests + Remove unused result files + Allow missing result files in runtest + Move regexp tests to runtest + Move SVG tests to runtest.c + Move testModule to new test suite + Move testThreads to new test suite + Remove major parts of old test suite + Make testchar return an error on failure + Add CI job for static build + python/tests: open() relative to test scripts + Port some test scripts to Python 3
* Documentation + Improve documentation of tree manipulation API + Update xml2-config man page + Consolidate man pages + Rename xmlcatalog_man.xml + Make examples a standalone HTML page + Fix documentation in entities.c + Add note about optimization flags
* Mon May 02 2022 David Anes - Update to 2.9.14:
* Security: + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer + Fix potential double-free in xmlXPtrStringRangeFunction + Fix memory leak in xmlFindCharEncodingHandler + Normalize XPath strings in-place + Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars() + Fix leak of xmlElementContent
* Bug fixes: + Fix parsing of subtracted regex character classes + Fix recursion check in xinclude.c + Reset last error in xmlCleanupGlobals + Fix certain combinations of regex range quantifiers + Fix range quantifier on subregex
* Improvements: + Fix recovery from invalid HTML start tags
* Build system, portability: + Define LFS macros before including system headers + Initialize XPath floating-point globals + configure: check for icu DEFS + configure.ac: produce tar.xz only (GNOME policy) + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER + Fix build with older Python versions + Fix --without-valid build
* Fri Mar 18 2022 Dominique Leuenberger - Build python bindings in a 2nd run, using multibuild: otherwise, libxml2 requires pkgconfig(libxml-2.0) to build, causing issues to bootstrap.
* Tue Mar 08 2022 Luciano Santos - Update to version 2.9.13:
* Security fixes: + [CVE-2022-23308] Use-after-free of ID and IDREF attributes (boo#1196490); + Several memory leaks and another issues.
* Many regressions fixes.
* Numerous bug fixes, including, among many others: + xmllint\'s --maxmem option should work as expected now; + xmllint now returns an error if arguments are missing.
* Numerous tests and code and fuzzing fixes and improvements.
* Updated documentation.- The full Libxml2 2.9.13 NEWS can be found here: https://download.gnome.org/sources/libxml2/2.9/\\ libxml2-2.9.13.news.- Replace version-release macros in all 3 Obsoletes tag with plain 2.9.13 to avoid unwanted behaviors in the future.- Remove dropped upstream AUTHORS file from list of files to be installed in the documentation location with \'cp\' command.- Update http://xmlsoft.org URL tag to Libxml2\'s new web home: https://gitlab.gnome.org/GNOME/libxml2.- Update ftp://xmlsoft.org Source tag to Libxml2\'s new download host: https://download.gnome.org.- Drop deprecated Python-2-related macro definitions/conditional statement from spec file.- Drop merged upstream patches: libxml2-fix-lxml-corrupted-subtree-structures.patch; libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.- Drop libxml2.keyring source file as the new download host doesn\'t offer GPG signatures.- Use ldconfig_scriptlets macro for post(un) handling.
* Wed Oct 20 2021 Matej Cepl - Rewrite package to the single-spec %python_subpackage_only style and eliminate unnecessary multibuild.
* Tue Jun 01 2021 Pedro Monreal - Fix python-lxml regression with libxml2 2.9.12:
* Work around lxml API abuse: gitlab.gnome.org/GNOME/libxml2/issues/255- Add upstream patches:
* libxml2-fix-lxml-corrupted-subtree-structures.patch
* libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch
* Tue Jun 01 2021 Ferdinand Thiessen - Update to version 2.9.12
* Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879), CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
* Fix null deref in legacy SAX1 parser
* Fix handling of unexpected EOF in xmlParseContent
* Fix user-after-free
* Validate UTF8 in xmlEncodeEntities
* Fix memory leak in xmlParseElementMixedContentDecl
* Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
* Fix SEGV in xmlSAXParseFileWithData
* Don\'t process siblings of root in xmlXIncludeProcess
* Full changes: http://xmlsoft.org/news.html- Drop upstream fixed
* libxml2-CVE-2021-3541.patch
* libxml2-CVE-2021-3537.patch
* libxml2-CVE-2021-3518.patch
* libxml2-CVE-2021-3517.patch
* libxml2-CVE-2021-3516.patch
* libxml2-CVE-2020-7595.patch
* libxml2-CVE-2019-20388.patch
* libxml2-CVE-2020-24977.patch
* libxml2-CVE-2019-19956.patch
* libxml2-python39.patch
* libxml2-Avoid-quadratic-checking-of-identity-constraints.patch- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch- Drop since 2.8.0 merged fix-perl.diff- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
* Wed May 19 2021 Pedro Monreal - Security fix: [bsc#1186015, CVE-2021-3541]
* Exponential entity expansion attack bypasses all existing protection mechanisms.- Add libxml2-CVE-2021-3541.patch
* Mon May 10 2021 Pedro Monreal - Security fix: [bsc#1185698, CVE-2021-3537]
* NULL pointer dereference in valid.c:xmlValidBuildAContentModel
* Add libxml2-CVE-2021-3537.patch
* Wed Apr 28 2021 Pedro Monreal - Security fix: [bsc#1185408, CVE-2021-3518]
* Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
* Add libxml2-CVE-2021-3518.patch
* Wed Apr 28 2021 Pedro Monreal - Security fix: [bsc#1185410, CVE-2021-3517]
* Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
* Add libxml2-CVE-2021-3517.patch
* Wed Apr 28 2021 Pedro Monreal - Security fix: [bsc#1185409, CVE-2021-3516]
* Fix use-after-free in entities.c:xmlEncodeEntitiesInternal()
* Add libxml2-CVE-2021-3516.patch
* Tue Feb 23 2021 Teemu Mannermaa - Fails to build against Python 3.9:
* Add upstream commit that fixes the issue https://github.com/GNOME/libxml2/commit/e4fb36841800038c289997432ca547c9bfef9db1- Add patch libxml2-python39.patch
* Thu Dec 17 2020 Pedro Monreal - Security fix: [bsc#1161521, CVE-2019-20388]
* Memory leak in xmlSchemaPreRun in xmlschemas.c- Add libxml2-CVE-2019-20388.patch
* Wed Nov 25 2020 Pedro Monreal - Avoid quadratic checking of identity-constraints: [bsc#1178823]
* key/unique/keyref schema attributes currently use qudratic loops to check their various constraints (that keys are unique and that keyrefs refer to existing keys).
* This fix uses a hash table to avoid the quadratic behaviour.- Add libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
* Fri Oct 23 2020 Benjamin Greiner - Make python subpackage ready for multiple python3 flavors gh#openSUSE/python-rpm-macros#66
* Mon Sep 07 2020 Pedro Monreal - Security fix: [bsc#1176179, CVE-2020-24977]
* xmllint: global-buffer-overflow in xmlEncodeEntitiesInternal- Add patch libxml2-CVE-2020-24977.patch
* Wed May 27 2020 Pedro Monreal Gonzalez - Fix invalid xmlns references since the fix for CVE-2019-19956 [bsc#1172021]- Revert upstream commit 5a02583c7e683896d84878bd90641d8d9b0d0549
* Add patch libxml2-CVE-2019-19956.patch
* Mon Mar 16 2020 Pedro Monreal Gonzalez - Security fix: [bsc#1161517, CVE-2020-7595]
* xmlStringLenDecodeEntities in parser.c has an infinite loop in a certain end-of-file situation- Add libxml2-CVE-2020-7595.patch
* Mon Mar 16 2020 Tomáš Chvátal - Do not pull in the non-python deps on the python build
* Sat Mar 14 2020 Tomáš Chvátal - Revert the previous change and use multibuild to determine supported flavors. We need to be able to enable/disable pythons in prjconf and multibuild directly clashes with that.
* Sun Dec 15 2019 Stefan Brüns - Build python2 and python3 bindings in separate flavors. As python3-libxml2 is a dependency of e.g. itstools and thus many other packages these packages no longer have a build dependency on python2. Breaks a build loop for python2.
* Thu Nov 28 2019 Pedro Monreal Gonzalez - Since libxml2-2.9.10 perl-XML-LibXSLT fails to build: [bsc#1157450]
* Revert upstream commit to make xmlFreeNodeList non-recursive https://github.com/GNOME/libxml2/commit/0762c9b69ba01628f72eada1c64ff3d361fb5716- Add patch libxml2-xmlFreeNodeList-recursive.patch
* Fri Nov 15 2019 Pedro Monreal Gonzalez - Version update to 2.9.10:
* Portability: + Fix exponent digits when running tests under old MSVC + Work around buggy ceil() function on AIX + Don\'t call printf with NULL string in runtest.c + Switched from unsigned long to ptrdiff_t in parser.c + timsort.h: support older GCCs + Make configure.ac work with older pkg-config
* Bug Fixes: + Fix for conditional sections at end of document + Make sure that Python tests exit with error code + Audit memory error handling in xpath.c + Fix error code in xmlTextWriterStartDocument + Fix integer overflow when counting written bytes + Fix uninitialized memory access in HTML parser + Fix memory leak in xmlSchemaValAtomicType + Disallow conditional sections in internal subset + Fix use-after-free in xmlTextReaderFreeNodeList + Fix Regextests + Fix empty branch in regex + Fix integer overflow in entity recursion check + Don\'t read external entities or XIncludes from stdin + Fix Schema determinism check of ##other namespaces + Fix potential null deref in xmlSchemaIDCFillNodeTables + Fix potential memory leak in xmlBufBackToBuffer + Fix error message when processing XIncludes with fallbacks + Fix memory leak in xmlRegEpxFromParse + 14:00 is a valid timezone for xs:dateTime + Fix memory leak in xmlParseBalancedChunkMemoryRecover + Fix potential null deref in xmlRelaxNGParsePatterns + Misleading error message with xs:{min|max}Inclusive + Fix memory leak in xmlXIncludeLoadTxt + Partial fix for comparison of xs:durations + Fix null deref in xmlreader buffer + Fix unability to RelaxNG-validate grammar with choice-based name class + Fix unability to validate ambiguously constructed interleave for RelaxNG + Fix possible null dereference in xmlXPathIdFunction + fix memory leak in xmlAllocOutputBuffer + Fix unsigned int overflow + dict.h: gcc 2.95 doesn\'t allow multiple storage classes + Fix another code path in xmlParseQName + Make sure that xmlParseQName returns NULL in error case + Fix build without reader but with pattern + Fix memory leak in xmlAllocOutputBufferInternal error path + Fix unsigned integer overflow + Fix return value of xmlOutputBufferWrite + Fix parser termination from \"Double hyphen within comment\" error + Fix call stack overflow in xmlFreePattern + Fix null deref in previous commit + Fix memory leaks in xmlXPathParseNameComplex error paths + Check for integer overflow in xmlXPtrEvalChildSeq + Fix xmllint dump of XPath namespace nodes + Fix float casts in xmlXPathSubstringFunction + Fix null deref in xmlregexp error path + Fix null pointer dereference in xmlTextReaderReadOuterXml + Fix memory leaks in xmlParseStartTag2 error paths + Fix memory leak in xmlSAX2StartElement + Fix commit \"Memory leak in xmlFreeID (xmlreader.c)\" + Fix NULL pointer deref in xmlTextReaderValidateEntity + Memory leak in xmlFreeTextReader + Memory leak in xmlFreeID (xmlreader.c)
* Improvements: + Propagate memory errors in valuePush + Propagate memory errors in xmlXPathCompExprAdd + Make xmlFreeDocElementContent non-recursive + Avoid ignored attribute warnings under GCC + Make xmlDumpElementContent non-recursive + Make apibuild.py ignore ATTRIBUTE_NO_SANITIZE + Mark xmlExp
* symbols as removed + Make xmlParseConditionalSections non-recursive + Adjust expected error in Python tests + Make xmlTextReaderFreeNodeList non-recursive + Make xmlFreeNodeList non-recursive + Make xmlParseContent and xmlParseElement non-recursive + Remove executable bit from non-executable files + Fix expected output of test/schemas/any4 + Optimize build instructions in README + xml2-config.in: Output CFLAGS and LIBS on the same line + xml2-config: Add a --dynamic switch to print only shared libraries + Annotate functions with __attribute__((no_sanitize)) + Fix warnings when compiling without reader or push parser + Remove unused member `doc` in xmlSaveCtxt + Limit recursion depth in xmlXPathCompOpEvalPredicate + Remove -Wno-array-bounds + Remove unreachable code in xmlXPathCountFunction + Improve XPath predicate and filter evaluation + Limit recursion depth in xmlXPathOptimizeExpression + Disable hash randomization when fuzzing + Optional recursion limit when parsing XPath expressions + Optional recursion limit when evaluating XPath expressions + Use break statements in xmlXPathCompOpEval + Optional XPath operation limit + Fix compilation with --with-minimum + Check XPath stack after calling functions + Remove debug printf in xmlreader.c + Always define LIBXML_THREAD_ENABLED when enabled + Fix unused function warning in testapi.c + Remove unneeded function pointer casts + Fix -Wcast-function-type warnings (GCC 8) + Fix -Wformat-truncation warnings (GCC 8)
* Cleanups: + Rebuild docs + Disable xmlExp regex code + Remove redundant code in xmlRelaxNGValidateState + Remove redundant code in xmlXPathCompRelationalExpr- Rebase patch fix-perl.diff
* Mon Sep 09 2019 Tomáš Chvátal - Do not depend on setuptools to keep the depgraph small and avoid build cycles
* Fri Aug 02 2019 Tomáš Chvátal - Use python[23]-libmxl2 as python names not python-libxml2-python which is kinda confusing
* Thu Aug 01 2019 Tomáš Chvátal - Do not ship libtool archive anymore
* Wed Jul 31 2019 Pedro Monreal Gonzalez - Enable tests also in the python subpackages
* Thu Jul 04 2019 Pedro Monreal Gonzalez - Added a new configurable variable XPATH_DEFAULT_MAX_NODESET_LENGTH to avoid nodeset limit when processing large XML files [bsc#1135123]
* Added libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch
* Mon Feb 25 2019 Pedro Monreal Gonzalez - Merge python-libxml2-python spec and changes files into the libxml2 ones using _multibuild [bsc#1126499, bsc#1123919]
* Sat Jan 26 2019 mgorseAATTsuse.com- Version update to 2.9.9:
* Security: + CVE-2018-9251 CVE-2018-14567 Fix infinite loop in LZMA decompression (boo#1088279 boo#1105166). + CVE-2018-14404 Fix nullptr deref with XPath logic ops (boo#1102046).
* Bug fixes: + Fix building relative URIs + Problem with data in interleave in RelaxNG validation + Fix memory leak in xmlSwitchInputEncodingInt error path + Set doc on element obtained from freeElems + Fix HTML serialization with UTF-8 encoding + Use actual doc in xmlTextReaderRead
*Xml + Unlink node before freeing it in xmlSAX2StartElement + Check return value of nodePush in xmlSAX2StartElement + Free input buffer in xmlHaltParser + Reset HTML parser input pointers on encoding failure + Fix xmlSchemaValidCtxtPtr reuse memory leak + Fix xmlTextReaderNext with preparsed document + HTML noscript should not close p + Don\'t change context node in xmlXPathRoot
* Improvements: + Remove redefined starts and defines inside include elements + Allow choice within choice in nameClass in RELAX NG + Look inside divs for starts and defines inside include + Add newlines to \'xmllint --xpath\' output + Don\'t include SAX.h from globals.h + Support xmlTextReaderNextSibling w/o preparsed doc + Improve restoring of context size and position + Simplify and harden nodeset filtering + Avoid unnecessary backups of the context node + Fix inconsistency in xmlXPathIsInf- Add libxml2-python3-string-null-check.patch: fix NULL pointer dereference when parsing invalid data (bsc#1065270 glgo#libxml2!15).).
* Tue Mar 20 2018 kukukAATTsuse.de- Use %license instead of %doc [bsc#1082318]
* Wed Mar 14 2018 tchvatalAATTsuse.com- Version update to 2.9.8:
* Various -Werror fixes and compilation updates as travis is now used by upstream
* Few additional tests added for ICU operations- Drop patch python3.6-verify_fd.patch merged upstream
* Sat Nov 11 2017 aavindraaAATTgmail.com- Version update to 2.9.7 release:
* Bug Fixes: + xmlcatalog: restore ability to query system catalog easily + Fix comparison of nodesets to strings
* Improvements: + Add Makefile rules to rebuild HTML man pages + Remove generated file python/setup.py from version control + Fix mixed decls and code in timsort.h + Rework handling of return values in thread tests + Fix unused variable warnings in testrecurse + Fix -Wimplicit-fallthrough warnings + Upgrade timsort.h to latest revision + Fix a couple of warnings in dict.c and threads.c + Fix unused variable warnings in nanohttp.c + Don\'t include winsock2.h in xmllint.c + Use __linux__ macro in generated code
* Portability: + Add declaration for DllMain + Fix preprocessor conditional in threads.h + Fix macro redefinition warning + many Windows specific improvements
* Documentation: + xmlcatalog: refresh man page wrt. quering system catalog easily- Includes bug fixes from 2.9.6:
* Fix XPath stack frame logic
* Report undefined XPath variable error message
* Fix regression with librsvg
* Handle more invalid entity values in recovery mode
* Fix structured validation errors
* Fix memory leak in LZMA decompressor
* Set memory limit for LZMA decompression
* Handle illegal entity values in recovery mode
* Fix debug dump of streaming XPath expressions
* Fix memory leak in nanoftp
* Fix memory leaks in SAX1 parser- Drop libxml2-bug787941.patch
* upstreamed in 3157cf4e53c03bc3da604472c015c63141907db8
* Sat Nov 11 2017 aavindraaAATTgmail.com- clean with spec-cleaner
* Thu Oct 26 2017 jmatejekAATTsuse.com- libxml2-python3-unicode-errors.patch: work around an issue with libxml2 supplied error strings being undecodable UTF-8 (bsc#1065270)
* Mon Oct 02 2017 jmatejekAATTsuse.com- convert to singlespec, build a python 3 version- change build instructions to use setup.py (and %python_build macros) instead of makefile-based approach- add python3.6-verify_fd.patch that fixes libxml2 on python 3.6- rename to python-libxml2-python to conform to package naming policy (PyPI name is \"libxml2-python\")
* Thu Sep 21 2017 jengelhAATTinai.de- Update package summaries and RPM groups. Trim descriptions for size on secondary subpackages. Replace install call by a commonly-used macro.
* Thu Sep 21 2017 tchvatalAATTsuse.com- Add patch to fix TW integration:
* libxml2-bug787941.patch
* Sun Sep 10 2017 tchvatalAATTsuse.com- Version update to 2.9.5 release:
* Merged all the previous cve fixes that were patched in
* Few small tweaks- Remove merged patches:
* libxml2-CVE-2016-4658.patch
* libxml2-CVE-2017-0663.patch
* libxml2-CVE-2017-5969.patch
* libxml2-CVE-2017-9047.patch
* libxml2-CVE-2017-9048.patch
* libxml2-CVE-2017-9049.patch
* libxml2-2.9.4-fix_attribute_decoding.patch
* Thu Jun 15 2017 pmonrealgonzalezAATTsuse.com- Security fix:
* libxml2-CVE-2017-0663.patch [bsc#1044337, CVE-2017-0663]
* Fix Heap buffer overflow in xmlAddID
* Wed Jun 14 2017 pmonrealgonzalezAATTsuse.com- Security fix:
* libxml2-CVE-2017-5969.patch [bsc#1024989, CVE-2017-5969]
* Fix NULL pointer deref in xmlDumpElementContent
* Mon May 22 2017 pmonrealgonzalezAATTsuse.com- Security fixes:
* libxml2-CVE-2017-9049.patch [bsc#1039066]
* heap-based buffer overflow (xmlDictComputeFastKey func)
* libxml2-CVE-2017-9048.patch [bsc#1039063]
* stack overflow vulnerability (xmlSnprintfElementContent func)
* libxml2-CVE-2017-9047.patch [bsc#1039064]
* stack overflow vulnerability (xmlSnprintfElementContent func)
* Tue Mar 07 2017 pmonrealgonzalezAATTsuse.com- Added libxml2-CVE-2016-4658.patch: Disallow namespace nodes in XPointer ranges. Namespace nodes must be copied to avoid use-after-free errors. But they don\'t necessarily have a physical representation in a document, so simply disallow them in XPointer ranges [bsc#1005544] [CVE-2016-4658]
* Wed Jun 08 2016 kstreitovaAATTsuse.com- add libxml2-2.9.4-fix_attribute_decoding.patch to fix attribute decoding during XML schema validation [bnc#983288]
* Fri May 27 2016 psimonsAATTsuse.com- Update libxml2 to version libxml2-2.9.4. The new version is resistant against CVE-2016-3627, CVE-2016-1833, CVE-2016-1835, CVE-2016-1837, CVE-2016-1836, CVE-2016-1839, CVE-2016-1838, CVE-2016-1840, CVE-2016-4483, CVE-2016-1834, CVE-2016-3705, and CVE-2016-1762.- Remove obsolete patches libxml2-2.9.1-CVE-2016-3627.patch, 0001-Add-missing-increments-of-recursion-depth-counter-to.patch, and libxml2-2.9.3-bogus_UTF-8_encoding_error.patch.
* Fri May 20 2016 kstreitovaAATTsuse.com- add libxml2-2.9.3-bogus_UTF-8_encoding_error.patch to fix XML push parser that fails with bogus UTF-8 encoding error when multi-byte character in large CDATA section is split across buffer [bnc#962796]
* Tue May 03 2016 sfleesAATTsuse.de- Add libxml2-2.9.1-CVE-2016-3627.patch to fix stack exhaustion while parsing certain XML files in recovery mode (CVE-2016-3627, bnc#972335).- Add 0001-Add-missing-increments-of-recursion-depth-counter-to.patch to improve protection against Billion Laughs Attack (bnc#975947).
* Tue Nov 24 2015 rpmAATTfthiessen.de- Update to new upstream release 2.9.3 (bsc#954429):
* Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819, CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500 and CVE-2015-8242
* And other bugfixes- Removed upstream fixed patches:
* libxml2-dont_initialize_catalog.patch
* 0001-Fix-missing-entities-after-CVE-2014-3660-fix.patch
* 0002-Adding-example-from-bugs-738805-to-regression-tests.patch
* Mon Nov 03 2014 vcizekAATTsuse.com- fix a missing entities after CVE-2014-3660 fix (https://bugzilla.gnome.org/show_bug.cgi?id=738805)
* added patches: 0001-Fix-missing-entities-after-CVE-2014-3660-fix.patch 0002-Adding-example-from-bugs-738805-to-regression-tests.patch
* Mon Nov 03 2014 vcizekAATTsuse.com- fix a regression in libxml2 2.9.2
* https://bugzilla.redhat.com/show_bug.cgi?id=1153753- add libxml2-dont_initialize_catalog.patch
* Fri Oct 31 2014 vcizekAATTsuse.com- update to 2.9.2
* drop libxml2-CVE-2014-3660.patch (upstream)
* add keyring to verify tarball Security: Fix for CVE-2014-3660 billion laugh variant CVE-2014-0191 Do not fetch external parameter entities Improvements: win32/libxml2.def.src after rebuild in doc elfgcchack.h: more legacy needs xmlSAX2StartElement() and xmlSAX2EndElement() elfgcchack.h: add xmlXPathNodeEval and xmlXPathSetContextNode Provide cmake module Fix a couple of issues raised by make dist Fix and add const qualifiers Preparing for upcoming release of 2.9.2 Fix zlib and lzma libraries check via command line wrong error column in structured error when parsing end tag doc/news.html: small update to avoid line join while generating NEWS. Add methods for python3 iterator Support element node traversal in document fragments xmlNodeSetName: Allow setting the name to a substring of the currently set name Added macros for argument casts adding init calls to xml and html Read parsing entry points Get rid of \'REPLACEMENT CHARACTER\' Unicode chars in xmlschemas.c Implement choice for name classes on attributes Two small namespace tweaks xmllint --memory should fail on empty files Cast encoding name to char pointer to match arg type
* Fri Oct 17 2014 vcizekAATTsuse.com- fix for CVE-2014-3660 (bnc#901546)
* denial of service via recursive entity expansion (related to billion laughs)
* added libxml2-CVE-2014-3660.patch