libxml2: Update to version 2.15.3

- Update from version 2.15.1 to 2.15.3
- Update of rootfile
- Five CVE fixes applied in 2.15.2
- Changelog
2.15.3
Security
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
Improvements
- schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
- xmlreader: propagate reader resource loaders to validator parsers
- python: Make python bindings python2 compatible
- xmlregexp: Fix escape-sequence character range matching
- xmlreader: Free input in xmlReaderForFd (memory-leak)
- xmlstring: Free cur on every error for xmlStrncat (memory-leak)
- catalog: Free xmlCatalogResolveCache on cleanup (memory leak)
- Fix nanohttp.c build when --without-output
- test: fix mismatched signed/unsigned comparison
2.15.2
Security
- CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
- CVE-2026-0990 fix: Prevent infinite recursion in
  xmlCatalogListXMLResolve
- CVE-2026-0992 fix: Exponential behavior when handling
- parser: Fix infinite loop in xmlCtxtParseContent
- CVE-2025-10911 libxslt related: Ignore next/prev of documents when
  traversing XPath
- CVE-2026-0989 fix: Add RelaxNG include limit
- xmlIO: use size_t for buffer size reallocation
- uri: fix signed integer overflow in xmlBuildRelativeURISafe
- schematron: fix memory leaks on error paths in xmlSchematronParseRule
- catalog: fix stack overflow from self-referencing SGML CATALOG entries
Improvements
- fuzz: Make fuzzy encoding match more lenient
- Fix C14N type confusion
- meson: Fix build with Meson < 1.3
- xmllint: Use zlib directly
- xmllint: New option to separate xpath results using null, --xpath0
- autotools: Make valgrind actually check for leaks
- meson: Add valgrind test setup
- Fix xmlOutputBufferGetContent output when encoder is set
- threads: don't force _WIN32_WINNT to Vista if it's set to a higher value
- dist: Add generated documentation to the dist as "dist-doc" folder
  to simplify downstream packaging of doc
- Fix xmlRemoveEntity removing from wrong hash table
- use duplicating variant in relaxng to mitigate UAF
- Fix memory leak in xmlTextWriterStartAttributeNS on OOM
- meson: remove hardcoded buildtype=debug default
- Fix memory leak of prefix in xmlTextWriterStartElementNS()
- writer: Add a few extra NULL checks to avoid memory leaks on corrupt
  writer path.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/rootfiles/common/libxml2 b/config/rootfiles/common/libxml2
index 779b249ead2790bf38e6fe036673fc330ce9f0fb..5a4f85793ae29ea64b6d77b6a61c7a43c4055fc3 100644 (file)
--- a/config/rootfiles/common/libxml2
+++ b/config/rootfiles/common/libxml2
@@ -54,5 +54,5 @@
 #usr/lib/libxml2.la
 #usr/lib/libxml2.so
 usr/lib/libxml2.so.16
-usr/lib/libxml2.so.16.1.1
+usr/lib/libxml2.so.16.1.3
 #usr/lib/pkgconfig/libxml-2.0.pc

diff --git a/lfs/libxml2 b/lfs/libxml2
index c1ea739ebf77f2679e03bb9afceb21f409ed9236..84ebb0a0ad4bfa6cb4b0294381363023c405dc55 100644 (file)
--- a/lfs/libxml2
+++ b/lfs/libxml2
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.15.1
+VER        = 2.15.3
 #          https://download.gnome.org/sources/libxml2/
 
 THISAPP    = libxml2-$(VER)
@@ -43,7 +43,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 73c4d17adacda67d71c5a120c7de2324df1db35963cadbe18166dafe122e1f10dcab9d4fed0e128c077a5ca31432bfaf72f742c42680251660d397ab8bc3538b
+$(DL_FILE)_BLAKE2 = 2ff478b46a40957386cd1ed0627bfc0f2433f47e786f20db3942304c90289adaeb1d9c3f12665df312b86cfac42f8e4dbc18e965bf90018f93c230b9b862df66
 
 install : $(TARGET)