From: Joshua Lock <joshua.lock@collabora.co.uk>
To: openembedded-core@lists.openembedded.org
Subject: Re: [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes
Date: Wed, 16 Dec 2015 21:05:02 +0000 [thread overview]
Message-ID: <5671D1FE.7010306@collabora.co.uk> (raw)
In-Reply-To: <1449344129-32738-1-git-send-email-akuster808@gmail.com>
Hi Armin,
On 05/12/15 19:35, Armin Kuster wrote:
> Each CVE is an independant patch so they can be easily merged to other distros
> and/or stable branches.
As others have mentioned elsewhere I think this would be much nicer if
each patch was added to the SRC_URI in the same commit which introduces
the patch.
In addition, I believe it would also make sense to have 2 patches for
the same CVE applied at once?
Ideally this series would be 11 patches, each of which updated SRC_URI
and added the patch files to fix a single CVE.
What do you think? I am more than happy to take this series and make the
suggested change (11 commits, each editing SRC_URI) myself before
requesting my fido-next branch be merged?
Thanks,
Joshua
> I have included two previous CVE's sent for jethro which can be ignored.
> I put the CVE's in order as there where fixed upstream.
>
> Armin Kuster (15):
> libxml2: security fix CVE-2015-7941-1
> libxml2: security fix CVE-2015-7941-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7942
> libxml2: security fix CVE-2015-7942-2
> libxml2: security fix CVE-2015-8317
> libxml2: security fix CVE-2015-7498
> libxml2: security fix CVE-2015-7497
> libxml2: security fix CVE-2015-7499-1
> libxml2: security fix CVE-2015-7499-2
> libxml2: depend fix security issue CVE-2015-7500
> libxml2: security fix CVE-2015-7500
> libxml2: security fix CVE-2015-8242
> libxml2: security fix CVE-2015-5312
> libxml2: multiple security fixes.
>
> meta/recipes-core/libxml/libxml2.inc | 14 +++
> ...-2015-5312-Another-entity-expansion-issue.patch | 39 ++++++
> ...97-Avoid-an-heap-buffer-overflow-in-xmlDi.patch | 40 ++++++
> ...00-Fix-memory-access-error-due-to-incorre.patch | 131 +++++++++++++++++++
> ...2015-8035-Fix-XZ-compression-support-loop.patch | 38 ++++++
> ...42-Buffer-overead-with-HTML-parser-in-pus.patch | 49 ++++++++
> ...n-name-parsing-at-the-end-of-current-inpu.patch | 138 +++++++++++++++++++++
> ...ssing-entities-after-encoding-conversion-.patch | 89 +++++++++++++
> ...99-1-Add-xmlHaltParser-to-stop-the-parser.patch | 88 +++++++++++++
> ...VE-2015-7499-2-Detect-incoherency-on-GROW.patch | 43 +++++++
> ...top-parsing-on-entities-boundaries-errors.patch | 39 ++++++
> ...leanup-conditional-section-error-handling.patch | 56 +++++++++
> ...ror-in-previous-Conditional-section-patch.patch | 35 ++++++
> ...iation-of-overflow-in-Conditional-section.patch | 39 ++++++
> ...ng-early-on-if-encoding-conversion-failed.patch | 42 +++++++
> 15 files changed, 880 insertions(+)
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-5312-Another-entity-expansion-issue.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7497-Avoid-an-heap-buffer-overflow-in-xmlDi.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-7500-Fix-memory-access-error-due-to-incorre.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8035-Fix-XZ-compression-support-loop.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-CVE-2015-8242-Buffer-overead-with-HTML-parser-in-pus.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/0001-Fix-a-bug-on-name-parsing-at-the-end-of-current-inpu.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7498-Avoid-processing-entities-after-encoding-conversion-.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-1-Add-xmlHaltParser-to-stop-the-parser.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7499-2-Detect-incoherency-on-GROW.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-1-Stop-parsing-on-entities-boundaries-errors.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7941-2-Cleanup-conditional-section-error-handling.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-2-Fix-an-error-in-previous-Conditional-section-patch.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942-Another-variation-of-overflow-in-Conditional-section.patch
> create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8317-Fail-parsing-early-on-if-encoding-conversion-failed.patch
>
next prev parent reply other threads:[~2015-12-16 21:05 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-05 19:35 [PATCH][jethro][fido][ 00/15] Libxml2: multiple security fixes Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 01/15] libxml2: security fix CVE-2015-7941-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 02/15] libxml2: security fix CVE-2015-7941-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 03/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 04/15] libxml2: security fix CVE-2015-7942 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 05/15] libxml2: security fix CVE-2015-7942-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 06/15] libxml2: security fix CVE-2015-8317 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 07/15] libxml2: security fix CVE-2015-7498 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 08/15] libxml2: security fix CVE-2015-7497 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 09/15] libxml2: security fix CVE-2015-7499-1 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 10/15] libxml2: security fix CVE-2015-7499-2 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 11/15] libxml2: depend fix security issue CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 12/15] libxml2: security fix CVE-2015-7500 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 13/15] libxml2: security fix CVE-2015-8242 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 14/15] libxml2: security fix CVE-2015-5312 Armin Kuster
2015-12-05 19:35 ` [PATCH][jethro][fido] 15/15] libxml2: multiple security fixes Armin Kuster
2015-12-08 8:16 ` [PATCH][jethro][fido][ 00/15] Libxml2: " Robert Yang
2015-12-16 21:05 ` Joshua Lock [this message]
2015-12-21 16:12 ` akuster808
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5671D1FE.7010306@collabora.co.uk \
--to=joshua.lock@collabora.co.uk \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.