From b93dd888b861aa6df97cd78b70fa9f757cfcdf61 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Mon, 23 Oct 2023 18:38:19 +0100 Subject: [PATCH] libxml2: ignore disputed CVE-2023-45322 This CVE is a use-after-free which theoretically can be an exploit vector, but this UAF only occurs when malloc() fails. As it's unlikely that the user can orchestrate malloc() failures at just the place to break on _this_ malloc and not others it is disputed that this is actually a security issue. The underlying bug has been fixed, and will be incorporated into the next release. Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- meta/recipes-core/libxml/libxml2_2.11.5.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-core/libxml/libxml2_2.11.5.bb b/meta/recipes-core/libxml/libxml2_2.11.5.bb index 4cf6dd09a9a..fc82912df25 100644 --- a/meta/recipes-core/libxml/libxml2_2.11.5.bb +++ b/meta/recipes-core/libxml/libxml2_2.11.5.bb @@ -21,6 +21,9 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt SRC_URI[archive.sha256sum] = "3727b078c360ec69fa869de14bd6f75d7ee8d36987b071e6928d4720a28df3a6" SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273" +# Disputed as a security issue, but fixed in d39f780 +CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail" + BINCONFIG = "${bindir}/xml2-config" PACKAGECONFIG ??= "python \ -- 2.47.3