Your message dated Sat, 07 Feb 2015 15:20:30 +0000 with message-id <[email protected]> and subject line Bug#768089: fixed in libxml2 2.7.8.dfsg-2+squeeze11 has caused the Debian Bug report #768089, regarding libxml2: CVE-2014-3660 patch makes installation-guide FTBFS to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 768089: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768089 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Source: libxml2 Version: 2.8.0+dfsg1-7+wheezy2 Severity: serious Justification: makes other package FTBFS Hello, The cve-2014-3660.patch patch makes installation-guide FTBFS: Entity: line 2: parser error : Detected an entity reference loop <ulink url="&downloadable-file;images/orion5x/network-console/buffalo/kuroboxpro ^ /tmp/manual/en/install-methods/download/arm.xml:40: parser error : Detected an entity reference loop ^ while there is actually no reference loop there. It seems cve-2014-3660.patch is assuming that git commit cff2546 is applied: notably it copies this code as it is: + ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; but in libxml2 2.8.0, it was still ent->checked = ctxt->nbentities - oldnbent + 1; and other parts of the code assume that too. The attached patch fixes this confusion. Samuel -- System Information: Debian Release: 8.0 APT prefers testing APT policy: (990, 'testing'), (500, 'buildd-unstable'), (500, 'unstable'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.18.0 (SMP w/8 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Init: systemd (via /run/systemd/system) -- Samuel Accroche-toi au terminal, j'enlève le shell... -+- nojhan -+---- /tmp/libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch.original 2015-01-01 14:48:26.337554556 +0100 +++ /tmp/libxml2-2.8.0+dfsg1/debian/patches/cve-2014-3660.patch 2015-01-01 14:48:53.000874666 +0100 @@ -6,11 +6,11 @@ parser.c | 42 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 38 insertions(+), 4 deletions(-) -diff --git a/parser.c b/parser.c -index 7ef712d..b435913 100644 ---- a/parser.c -+++ b/parser.c -@@ -127,6 +127,29 @@ xmlParserEntityCheck(xmlParserCtxtPtr ctxt, size_t size, +Index: libxml2-2.8.0+dfsg1/parser.c +=================================================================== +--- libxml2-2.8.0+dfsg1.orig/parser.c 2015-01-01 13:20:23.913738969 +0000 ++++ libxml2-2.8.0+dfsg1/parser.c 2015-01-01 13:47:31.930940787 +0000 +@@ -127,6 +127,27 @@ return (0); if (ctxt->lastError.code == XML_ERR_ENTITY_LOOP) return (1); @@ -29,10 +29,8 @@ + rep = xmlStringDecodeEntities(ctxt, ent->content, + XML_SUBSTITUTE_REF, 0, 0, 0); + -+ ent->checked = (ctxt->nbentities - oldnbent + 1) * 2; ++ ent->checked = ctxt->nbentities - oldnbent + 1; + if (rep != NULL) { -+ if (xmlStrchr(rep, '<')) -+ ent->checked |= 1; + xmlFree(rep); + rep = NULL; + }
--- End Message ---
--- Begin Message ---Source: libxml2 Source-Version: 2.7.8.dfsg-2+squeeze11 We believe that the bug you reported is fixed in the latest version of libxml2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Thorsten Alteholz <[email protected]> (supplier of updated libxml2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 07 Feb 2015 15:05:28 +0100 Source: libxml2 Binary: libxml2 libxml2-utils libxml2-dev libxml2-dbg libxml2-doc python-libxml2 python-libxml2-dbg Architecture: source i386 all Version: 2.7.8.dfsg-2+squeeze11 Distribution: squeeze-lts Urgency: high Maintainer: Debian XML/SGML Group <[email protected]> Changed-By: Thorsten Alteholz <[email protected]> Description: libxml2 - GNOME XML library libxml2-dbg - Debugging symbols for the GNOME XML library libxml2-dev - Development files for the GNOME XML library libxml2-doc - Documentation for the GNOME XML library libxml2-utils - XML utilities python-libxml2 - Python bindings for the GNOME XML library python-libxml2-dbg - Python bindings for the GNOME XML library (debug extension) Closes: 768089 Changes: libxml2 (2.7.8.dfsg-2+squeeze11) squeeze-lts; urgency=high . * Non-maintainer upload by the Squeeze LTS Team. * Do not fetch external parsed entities unless asked to do so. This supplements the patch for CVE-2014-0191 * Fix regression introducedd by the patch fixing CVE-2014-3660 (Closes: #768089) Checksums-Sha1: 727c78ebea4ba8de94b755587027bf5197c4f7b5 2311 libxml2_2.7.8.dfsg-2+squeeze11.dsc bf481743478da6899a65507a34b67731466960dd 3509930 libxml2_2.7.8.dfsg.orig.tar.gz 7fe25afb2b54786f157ca4fed50e1118cbd44192 124146 libxml2_2.7.8.dfsg-2+squeeze11.diff.gz 7c3efdc09799e40dab7fdb5b590875518261b8a0 829678 libxml2_2.7.8.dfsg-2+squeeze11_i386.deb 821ec3d8ab182b2fdaede480694770b945794896 91234 libxml2-utils_2.7.8.dfsg-2+squeeze11_i386.deb 2fd33659fb296f2e36424f5c0413cb9e4b3bfb8f 752812 libxml2-dev_2.7.8.dfsg-2+squeeze11_i386.deb 9aba397ec91dec96ecc30cdca0dac529f4e41845 991576 libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb 8d0da21b701da9a2c1afccb5125b45caec11d3d2 1382872 libxml2-doc_2.7.8.dfsg-2+squeeze11_all.deb 1beed0bfeb52cc086abf2e090a938c71c0a5b3c9 309832 python-libxml2_2.7.8.dfsg-2+squeeze11_i386.deb 9b6bf557c6a50bafaa057037e4e4fd44a872928f 825042 python-libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb Checksums-Sha256: 5bb3cfd4901d9dd8fe52d13f1c183c61e644b7d22faa5abafd57dcb7a1d04a70 2311 libxml2_2.7.8.dfsg-2+squeeze11.dsc 9f5262963fda356708903b42ff862a816c714582d0cf41477a8b3839945f0e43 3509930 libxml2_2.7.8.dfsg.orig.tar.gz 118229e9d3b5d13192f3c65460dd1598e741befdb5ebe3db69f9269887b157af 124146 libxml2_2.7.8.dfsg-2+squeeze11.diff.gz 1cc36b8b15ea92db96997cf5a743acd51a693d408433be51ca6d7b6512571c5a 829678 libxml2_2.7.8.dfsg-2+squeeze11_i386.deb aa67dfc7cf15a58b6ae10f0d81e48e5f3b4b1e077c27ee64b405a6f397e1fbac 91234 libxml2-utils_2.7.8.dfsg-2+squeeze11_i386.deb 0536a45df065ce8deb6149d59c15c3f87e5ae3f167965c539821588e3807673a 752812 libxml2-dev_2.7.8.dfsg-2+squeeze11_i386.deb b8f3bd576fc5162102147e77d59284bcb5424e7057a06b65fcab2da99c2a046d 991576 libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb 226eead1bb7ad06b01ad81938474714394a0d96ebb832cc253de4268ac5c74fe 1382872 libxml2-doc_2.7.8.dfsg-2+squeeze11_all.deb 042038671d2c48725bc700fd1b83546031ff66d5fae88e372f6ab7aeef95a072 309832 python-libxml2_2.7.8.dfsg-2+squeeze11_i386.deb c8ccb4864a319ee669271e4304d44b982dd2f265d2b2b0b434c387f31d8fada5 825042 python-libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb Files: 5c06d03f7fa4054876a5010cf1410b1d 2311 libs optional libxml2_2.7.8.dfsg-2+squeeze11.dsc 116fd86aa1b392dfe38d6b17613deebb 3509930 libs optional libxml2_2.7.8.dfsg.orig.tar.gz efae2c3f5612658803689f4da7ce629e 124146 libs optional libxml2_2.7.8.dfsg-2+squeeze11.diff.gz cc5eb306a01f62bc0a0c8394f09728e3 829678 libs standard libxml2_2.7.8.dfsg-2+squeeze11_i386.deb 0fbe3db5675b23cc7c0522f0d3a35602 91234 text optional libxml2-utils_2.7.8.dfsg-2+squeeze11_i386.deb a2c1a3ba3ee22d47dae5efc14e932f1d 752812 libdevel optional libxml2-dev_2.7.8.dfsg-2+squeeze11_i386.deb d5d247b0c59c42b73ba037a366820c49 991576 debug extra libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb 0dd71b0e582f22b5d8b889821a4a9adf 1382872 doc optional libxml2-doc_2.7.8.dfsg-2+squeeze11_all.deb a0f595d8ed73fe301631449a96695264 309832 python optional python-libxml2_2.7.8.dfsg-2+squeeze11_i386.deb 689fab2ddb5cd7818997973c70bf4769 825042 debug extra python-libxml2-dbg_2.7.8.dfsg-2+squeeze11_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQJ8BAEBCgBmBQJU1h6gXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ2MjAxRkJGRkRCQkRFMDc4MjJFQUJCOTY5 NkZDQUMwRDM4N0I1ODQ3AAoJEJb8rA04e1hHJQkQAI5U+i+EcKVyi79T5RRnVRgJ qrHzuF8zEWo2/Maz/1NT7Al2rFIeRenFgDrM4sBVvWcg9nFOigml6qh2VhoIDJQS Q5XMLn8MnUu2htQyV2AEjuc6ZM9UQjpcjfSGJFtiZH/1zmH9nhNX9SZYENTSQfTw dBVr/gzMFkxmgJRrPRX2CYSxFCJvBc55RnvhNr7hszNn8L6T16qGlXiwb5P9vF8C 3iIRY4rE1qElSJFokgrVdXFZ/SJ/su7tDGuU4nWnm8BTYuELpjIesvOtrmKwQxJa 2uhpNctbfctzghzEmitYOSXzOrPOsIVVLmrfaCDnKVrQc36VSoTus4naWcu9T7du UKkWOkNmVoTyWZJXsdlYN9TDCm/X7+zSJt88jNhBiVCnY9v5TupGH3MGTdRunD5x Lz0ur2SJiKoJjN1xfHozdXyQLJ5R/ol5WhOE67+Zrk7oxGSgyVx2p3dIFwpeqBwi vtiLPMfU/9R5PcsZIhOS97LMHNWUzK767BBVbEJ5WTwjIei1/BjEd795gSm0pGGg AdfjuTddF5YHap8X2sPe+2ATuP8b9819ubF4Z8hnze4cybFJ+hSgHRzYCFnyLExl 0OvkyAIbQJPSApPXBf8I5Tw2mQvCB17+gpe5MwbW0ehUJ8ra2Bc1QuGJl5Sa9wXc 8Em4m0YJUEa2oSSU/uf6 =7F/h -----END PGP SIGNATURE-----
--- End Message ---
