Debian Package Tracker

general

source: libxml2 (main)
version: 2.9.4+dfsg1-8
maintainer: Debian XML/SGML Group (archive) (DMD)
uploaders: YunQiang Su [DMD] – Aron Xu [DMD]
arch: all any
std-ver: 4.1.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.9.1+dfsg1-5+deb8u6
o-o-sec: 2.9.1+dfsg1-5+deb8u8
oldstable: 2.9.4+dfsg1-2.2+deb9u2
old-sec: 2.9.4+dfsg1-2.2+deb9u2
stable: 2.9.4+dfsg1-7
testing: 2.9.4+dfsg1-8
unstable: 2.9.4+dfsg1-8
exp: 2.9.10+dfsg-1

versioned links

2.9.1+dfsg1-5+deb8u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.1+dfsg1-5+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.4+dfsg1-2.2+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.4+dfsg1-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.4+dfsg1-8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.10+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libxml2 (25 bugs: 0, 21, 4, 0)
libxml2-dbg
libxml2-dev (4 bugs: 0, 3, 1, 0)
libxml2-doc
libxml2-utils (14 bugs: 0, 9, 5, 0)
python-libxml2
python-libxml2-dbg
python3-libxml2
python3-libxml2-dbg

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

unrecognized option compress=xz

Created: 2018-01-02 Last update: 2020-02-18 06:35

A new upstream version is available: 2.9.10 high

A new upstream version 2.9.10 is available, you should consider packaging it.

Created: 2017-12-04 Last update: 2020-02-18 06:35

8 security issues in buster high

There are 8 open security issues in buster.

2 important issues:

CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

6 issues skipped by the security teams:

CVE-2017-18258: The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVE-2018-14404: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Please fix them.

Created: 2017-06-18 Last update: 2020-01-23 17:31

8 security issues in bullseye high

There are 8 open security issues in bullseye.

8 important issues:

CVE-2017-18258: The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVE-2018-14404: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Please fix them.

Created: 2019-07-07 Last update: 2020-01-23 17:31

8 security issues in sid high

There are 8 open security issues in sid.

8 important issues:

CVE-2017-18258: The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVE-2018-14404: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Please fix them.

Created: 2016-01-26 Last update: 2020-01-23 17:31

11 security issues in stretch high

There are 11 open security issues in stretch.

2 important issues:

CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

9 issues skipped by the security teams:

CVE-2017-18258: The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2017-5969: ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."
CVE-2017-5130: An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
CVE-2019-19956: xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.
CVE-2017-8872: The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
CVE-2018-14567: libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
CVE-2018-14404: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.

Please fix them.

Created: 2016-01-26 Last update: 2020-01-23 17:31

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

python-libxml2-dbg could be marked Multi-Arch: same

Created: 2020-02-11 Last update: 2020-02-18 02:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.9.10+dfsg-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 052d473ae8326801d4763d598ea48992c52e1605
Author: Mattia Rizzolo <mattia@debian.org>
Date:   Thu Jan 16 14:05:15 2020 +0100

    mention more old CVEs in the changelog
    
    Signed-off-by: Mattia Rizzolo <mattia@debian.org>

commit 06f50ef5d1e3ae069a1b28eb5e6297204fa8ce74
Author: Mattia Rizzolo <mattia@debian.org>
Date:   Thu Jan 16 13:57:35 2020 +0100

    python-libxml2-dbg: Depend on python2-dbg instead of python-dbg. Closes: #948493
    
    Signed-off-by: Mattia Rizzolo <mattia@debian.org>

commit ca594ede70250ec42e08f5747a191ff57d1e08e2
Author: Mattia Rizzolo <mattia@debian.org>
Date:   Thu Jan 16 13:56:31 2020 +0100

    Re-instate Python2 support for now, the rev-deps are not ready. Re-opens: #936941
    
    Signed-off-by: Mattia Rizzolo <mattia@debian.org>

Created: 2020-01-16 Last update: 2020-02-14 00:34

8 ignored security issues in jessie low

There are 8 open security issues in jessie.

8 issues skipped by the security teams:

CVE-2016-4448: Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVE-2016-9318: libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
CVE-2017-5969: ** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document. NOTE: The maintainer states "I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser."
CVE-2019-20388: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2017-5130: An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.
CVE-2017-8872: The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.
CVE-2020-7595: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2017-16932: parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

Please fix them.

Created: 2016-01-26 Last update: 2020-01-23 17:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.1.3).

Created: 2018-04-16 Last update: 2020-01-21 05:06

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2019-12-28] Accepted libxml2 2.9.1+dfsg1-5+deb8u8 (source amd64 all) into oldoldstable (Chris Lamb)
[2019-11-25] Accepted libxml2 2.9.10+dfsg-1 (source) into experimental (Mattia Rizzolo)
[2019-11-21] libxml2 2.9.4+dfsg1-8 MIGRATED to testing (Debian testing watch)
[2019-11-19] Accepted libxml2 2.9.9+dfsg1-1~exp2 (source) into experimental (Mattia Rizzolo)
[2019-11-19] Accepted libxml2 2.9.4+dfsg1-8 (source) into unstable (Mattia Rizzolo)
[2019-10-29] Accepted libxml2 2.9.9+dfsg1-1~exp1 (source) into experimental (Aron Xu)
[2018-10-03] Accepted libxml2 2.9.8+dfsg-1 (source) into experimental (Mattia Rizzolo)
[2018-09-27] Accepted libxml2 2.9.1+dfsg1-5+deb8u7 (source amd64 all) into oldstable (Thorsten Alteholz)
[2018-05-27] libxml2 2.9.4+dfsg1-7 MIGRATED to testing (Debian testing watch)
[2018-05-26] Accepted libxml2 2.9.4+dfsg1-7 (source) into unstable (Rene Engelhard)
[2018-02-10] Accepted libxml2 2.9.1+dfsg1-5+deb8u6 (all source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Salvatore Bonaccorso)
[2018-02-08] Accepted libxml2 2.9.4+dfsg1-2.2+deb9u2 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2018-01-07] libxml2 2.9.4+dfsg1-6.1 MIGRATED to testing (Debian testing watch)
[2018-01-03] Accepted libxml2 2.9.7+dfsg-1 (source) into experimental (Mattia Rizzolo)
[2018-01-02] Accepted libxml2 2.9.4+dfsg1-6.1 (source) into unstable (Salvatore Bonaccorso)
[2018-01-02] Accepted libxml2 2.9.4+dfsg1-6 (source) into unstable (Mattia Rizzolo)
[2017-12-20] libxml2 2.9.4+dfsg1-5.2 MIGRATED to testing (Debian testing watch)
[2017-12-18] Accepted libxml2 2.8.0+dfsg1-7+wheezy12 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2017-12-14] Accepted libxml2 2.9.4+dfsg1-5.2 (source) into unstable (Salvatore Bonaccorso)
[2017-11-30] Accepted libxml2 2.8.0+dfsg1-7+wheezy11 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2017-11-24] libxml2 2.9.4+dfsg1-5.1 MIGRATED to testing (Debian testing watch)
[2017-11-23] Accepted libxml2 2.8.0+dfsg1-7+wheezy10 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2017-11-18] Accepted libxml2 2.9.4+dfsg1-5.1 (source) into unstable (Salvatore Bonaccorso)
[2017-10-20] libxml2 2.9.4+dfsg1-5 MIGRATED to testing (Debian testing watch)
[2017-10-15] Accepted libxml2 2.9.4+dfsg1-5 (source) into unstable (Mattia Rizzolo)
[2017-09-09] libxml2 2.9.4+dfsg1-4 MIGRATED to testing (Debian testing watch)
[2017-09-04] Accepted libxml2 2.9.4+dfsg1-4 (source) into unstable (Mattia Rizzolo)
[2017-08-30] libxml2 2.9.4+dfsg1-3.1 MIGRATED to testing (Debian testing watch)
[2017-08-23] Accepted libxml2 2.9.1+dfsg1-5+deb8u5 (all source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Salvatore Bonaccorso)
[2017-08-23] Accepted libxml2 2.9.4+dfsg1-2.2+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)

bugs [bug history graph]

all: 50
RC: 0
I&N: 39
M&W: 10
F&P: 1
patch: 0

links

homepage
buildd: logs, exp, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci