Created attachment 248271 [details] Patch for libxml2 Fixes CVE-2024-25062 Reference: https://www.cve.org/CVERecord?id=CVE-2024-25062 Compile and runtime tested on FreeBSD 14.0-RELEASE (amd64) (make, make check-plist, make test) Compile and runtime tested on FreeBSD 14.0-RELEASE (aarch64) (make, make check-plist, make test) Poudriere testport OK 14.0-RELEASE (amd64) Poudriere testport OK 13.2-RELEASE (amd64) Tested with following consumers in 14.0-RELEASE (amd64) using Poudriere: x11/yelp x11/xsnow x11/xscreensaver x11/xkeyboard-config x11/xfce4-screenshooter-plugin x11/xcb-proto x11/xapp x11/workrave x11/wf-shell x11/wcm x11/wbar x11/waybar x11/swaysettings x11/roxterm x11/plank x11/pipeglade x11/nwg-launchers x11/mate-session-manager x11/mate-applets (fails, itstool coredumps) x11/lxpanel x11/libxklavier x11/libxkbcommon x11/keyboardcast x11/jgmenu x11/gstreamer1-plugins-ximagesrc x11/gstreamer1-plugins-x x11/gnome-terminal x11/gnome-shell x11/gnome-pie x11/gnome-console x11/cinnamon-screensaver x11/cinnamon x11/budgie-screensaver x11/apwal x11-wm/openbox x11-wm/obconf-qt x11-wm/obconf x11-wm/metacity x11-wm/lxsession x11-wm/lxappearance-obconf x11-wm/libcompizconfig x11-wm/labwc x11-wm/compiz-plugins-unsupported x11-wm/compiz-plugins-main x11-wm/compiz-plugins-extra x11-wm/compiz x11-toolkits/tepl6 x11-toolkits/rubygem-gtksourceview4 x11-toolkits/rubygem-gtksourceview3 x11-toolkits/pangomm x11-toolkits/p5-Glade2 x11-toolkits/ocaml-lablgtk3 x11-toolkits/ocaml-lablgtk2 x11-toolkits/guile-gnome-platform x11-toolkits/gtksourceviewmm3 x11-toolkits/gtksourceview5 x11-toolkits/gtksourceview4 x11-toolkits/gtksourceview3 x11-toolkits/gtksourceview2 x11-toolkits/gtkmm30 x11-toolkits/gtkmm24 x11-toolkits/gtk-sharp20 x11-toolkits/gstreamer1-plugins-pango x11-toolkits/gstreamer1-plugins-gtk x11-toolkits/gdl x11-toolkits/copperspice x11-themes/plata-theme x11-themes/adapta-gtk-theme x11-themes/adapta-backgrounds x11-fonts/font-manager x11-fonts/afdko x11-fm/sushi x11-fm/rox-filer x11-fm/rodent x11-fm/polo x11-fm/nemo x11-fm/nautilus-python x11-fm/librfm x11-fm/fsv2 x11-fm/caja x11-clocks/cairo-clock www/webkit2-gtk4 www/webkit2-gtk3 www/ungoogled-chromium (fails) www/trafficserver www/tidy-html5 www/sitecopy www/rsstool www/rssroll www/qt6-webengine www/qt5-webengine www/py-html5-parser www/pecl-solr www/nginx-full www/nghttp2 www/newsboat www/mod_security www/mod_php83 www/mod_php82 www/mod_php81 www/kannel-sqlbox www/kannel www/iridium (fails) www/hurl www/hiawatha www/gstreamer1-plugins-srt www/gstreamer1-plugins-neon www/gnome-user-share www/flickcurl www/epiphany www/davix www/cssed www/chromium (fails) www/castget www/bluefish www/badwolf www/aria2 www/apache24 www/angie-module-dav-ext textproc/zorba textproc/yelp-xsl textproc/yelp-tools textproc/xmlwrapp textproc/xmlto textproc/xmlstarlet textproc/xmlroff textproc/wv2 textproc/wv textproc/ucto textproc/ssddiff textproc/rubygem-ruby-xslt textproc/rubygem-ruby-augeas textproc/rubygem-nokogumbo textproc/rubygem-nokogiri111 textproc/rubygem-nokogiri textproc/rubygem-libxml-ruby textproc/raptor2 textproc/py-libxml2 textproc/php83-xsl textproc/php83-xmlwriter textproc/php83-xmlreader textproc/php83-xml textproc/php83-simplexml textproc/php83-dom textproc/php82-xsl textproc/php82-xmlwriter textproc/php82-xmlreader textproc/php82-xml textproc/php82-simplexml textproc/php82-dom textproc/php81-xsl textproc/php81-xmlwriter textproc/php81-xmlreader textproc/php81-xml textproc/php81-simplexml textproc/php81-dom textproc/p5-XML-LibXSLT textproc/p5-XML-LibXML textproc/p5-XML-CanonicalizeXML textproc/meld textproc/lttoolbox textproc/libxslt textproc/libxml++30 textproc/libxml++26 textproc/libxml++ textproc/libwpd010 textproc/libvisio01 textproc/libtranslate textproc/libodfgen01 textproc/liblingoteach textproc/libgepub textproc/libfolia textproc/libfo textproc/libe-book textproc/libcroco textproc/libabw textproc/lasem textproc/gtk-doc textproc/gstreamer1-plugins-zxing textproc/gspell textproc/gmetadom (fails, unrelated) textproc/gdome2 textproc/ebook-tools textproc/docbook2X textproc/diffmark textproc/augeas textproc/asciidoc textproc/apertium textproc/R-cran-xml2 textproc/R-cran-XML sysutils/xen-tools sysutils/wimlib sysutils/upower sysutils/tracker3 sysutils/tracker-miners sysutils/tracker sysutils/quicksynergy sysutils/osinfo-db-tools sysutils/nix sysutils/nitrogen sysutils/mate-system-monitor sysutils/mate-control-center sysutils/ltfs sysutils/libdnf sysutils/khelpcenter sysutils/jstest-gtk sysutils/gstreamer1-plugins-cdio sysutils/gsmartcontrol sysutils/graveman sysutils/gnome-system-monitor sysutils/gnome-control-center sysutils/gconf-editor sysutils/gapcmon sysutils/fusefs-s3fs sysutils/darling-dmg sysutils/consolekit2 sysutils/cluster-glue sysutils/cinnamon-settings-daemon sysutils/cinnamon-control-center sysutils/cfengine323 sysutils/cfengine322 sysutils/cfengine321 sysutils/cfengine320 sysutils/cfengine-lts sysutils/cfengine-devel sysutils/cfengine sysutils/bulk_extractor sysutils/budgie-control-center sysutils/brasero sysutils/bacula-libs3 sysutils/accountsservice security/xmlsec1 security/stoken security/sssd-devel (fails, unrelated (plist issue)) security/sssd security/py-xmlsec security/pwman security/openconnect security/openca-ocspd security/oath-toolkit security/modsecurity3 security/libsecret security/libpki security/lastpass-cli security/lasso security/kc security/gvmd (fails, unrelated) security/gvm-libs security/gstreamer1-plugins-dtls security/gsad security/gonepass security/gnome-keyring security/clamav-lts security/clamav security/bzrtp security/beid science/salome-kernel science/qwalk science/qmcpack science/py-pymol science/precice science/paraview science/orthanc science/openmodelica science/openbabel science/lammps science/gromacs science/ghmm science/ghemical science/gchemutils science/fleur science/code_saturne science/chrono science/chemical-mime-data (fails, unrelated) science/afni science/abinit print/xreader print/simple-fb2-reader print/scribus-devel print/scribus print/pdfchain print/miktex print/foomatic-db-engine print/fontforge news/nzbget net/yaz net/wireshark net/vinagre net/rubygem-ovirt-engine-sdk net/php83-soap net/php82-soap net/php81-soap net/pecl-xmlrpc net/pacemaker2 net/opensips31 net/ns3 (fails, unrelated) net/mobile-broadband-provider-info net/mediastreamer net/liferea net/librest1 net/libmateweather net/liblinphone net/libgweather4 net/libgweather net/libgrss net/libcmis net/kitinerary net/kamailio net/gupnp-tools net/gupnp-av net/gupnp net/gstreamer1-plugins-srtp net/grilo-plugins net/grilo net/gnome-online-miners net/gnome-online-accounts net/gnome-nettool net/glusterfs net/gfbgraph net/fort net/asterisk18 net/Sockets net-p2p/tooth net-p2p/retroshare net-p2p/minder net-p2p/microdc2 net-p2p/linuxdcpp net-p2p/gtk-gnutella net-p2p/dclib net-mgmt/zabbix64-server net-mgmt/zabbix64-proxy net-mgmt/zabbix64-java net-mgmt/zabbix64-agent net-mgmt/zabbix6-server net-mgmt/zabbix6-proxy net-mgmt/zabbix6-java net-mgmt/zabbix6-agent net-mgmt/zabbix5-server net-mgmt/zabbix5-proxy net-mgmt/virt-viewer net-mgmt/torrus net-mgmt/ndpmon net-mgmt/lldpd net-mgmt/fence-agents net-im/telepathy-salut net-im/telepathy-qt net-im/telepathy-mission-control net-im/telepathy-logger-qt5 net-im/telepathy-logger net-im/telepathy-idle net-im/telepathy-glib net-im/telepathy-gabble net-im/telepathy-farstream net-im/signal-desktop net-im/pidgin-twitter net-im/pidgin-sipe net-im/pidgin net-im/libpurple net-im/libaccounts-glib net-im/kopete net-im/fractal net-im/folks net-im/finch multimedia/vlc multimedia/vcdimager multimedia/totem-pl-parser multimedia/totem multimedia/ogmrip multimedia/mythtv multimedia/mlt7 multimedia/libbluray multimedia/kodi multimedia/handbrake multimedia/gstreamermm multimedia/gstreamer1-plugins-x265 multimedia/gstreamer1-plugins-x264 multimedia/gstreamer1-plugins-vpx multimedia/gstreamer1-plugins-v4l2 multimedia/gstreamer1-plugins-ugly multimedia/gstreamer1-plugins-ttml multimedia/gstreamer1-plugins-theora multimedia/gstreamer1-plugins-smoothstreaming multimedia/gstreamer1-plugins-rtmp multimedia/gstreamer1-plugins-resindvd multimedia/gstreamer1-plugins-openh264 multimedia/gstreamer1-plugins-msdk multimedia/gstreamer1-plugins-mplex multimedia/gstreamer1-plugins-mpeg2enc multimedia/gstreamer1-plugins-mpeg2dec multimedia/gstreamer1-plugins-libde265 multimedia/gstreamer1-plugins-hls multimedia/gstreamer1-plugins-good multimedia/gstreamer1-plugins-dvdread multimedia/gstreamer1-plugins-dv multimedia/gstreamer1-plugins-dts multimedia/gstreamer1-plugins-dash multimedia/gstreamer1-plugins-bad multimedia/gstreamer1-plugins-assrender multimedia/gstreamer1-plugins-aom multimedia/gstreamer1-plugins multimedia/gstreamer1-editing-services multimedia/ffmpeg4 multimedia/ffmpeg multimedia/dvdauthor multimedia/cheese multimedia/avidemux-qt5 multimedia/avidemux-plugins multimedia/avidemux-cli multimedia/avidemux multimedia/audacious-plugins misc/xiphos misc/xfce4-weather-plugin misc/visp misc/tellico misc/shared-mime-info misc/py-pyqir misc/parley misc/libsupertone misc/librepo misc/liblxi misc/libiio misc/libcomps misc/iio-oscilloscope (fails, unrelated and marked BROKEN) misc/hotkeys misc/gnome-user-docs misc/gnome-getting-started-docs misc/gimp-help-en misc/copperspice-examples math/timbl math/tablix math/scilab math/sc-im math/qalculate-gtk math/py-igraph math/pspp math/polymake math/pdal math/openturns math/mdal math/mate-calc (fails, itstool coredumps) math/libqalculate math/igraph math/gretl math/gnumeric math/gnome-calculator math/gkmap math/ggobi math/drgeo math/coq math/cadabra2 math/R-cran-igraph mail/gnubiff mail/geary mail/evolution-ews mail/evolution mail/cone mail/balsa mail/astroid lang/vala lang/php83 lang/php82 lang/php81 lang/gnustep-base lang/gnu-cobol lang/frawk lang/ferite lang/crystal lang/cling java/openjfx14 irc/hexchat graphics/yafaray graphics/xournalpp graphics/xournal graphics/wayland graphics/waffle graphics/tinyows graphics/synfigstudio graphics/synfig graphics/swfmill graphics/shotwell graphics/sane-backends graphics/sane-airscan graphics/rawtherapee (fails, unrelated) graphics/rawstudio graphics/qgis-ltr graphics/qgis graphics/poppler-utils graphics/poppler-qt6 graphics/poppler-qt5 graphics/poppler-glib graphics/poppler graphics/podofo graphics/oyranos graphics/openslide graphics/openfx-arena graphics/opencollada graphics/nip2 graphics/minder graphics/mapnik graphics/libsvg graphics/librsvg2-rust graphics/librsvg2 graphics/libopenraw graphics/libkdcraw graphics/libgphoto2 graphics/libgnomecanvasmm26 graphics/libetonyek01 graphics/inkscape graphics/iccxml graphics/gstreamer1-plugins-zbar graphics/gstreamer1-plugins-webp graphics/gstreamer1-plugins-vulkan graphics/gstreamer1-plugins-rsvg graphics/gstreamer1-plugins-qt graphics/gstreamer1-plugins-png graphics/gstreamer1-plugins-openjpeg graphics/gstreamer1-plugins-openexr graphics/gstreamer1-plugins-opencv graphics/gstreamer1-plugins-libvisual graphics/gstreamer1-plugins-libcaca graphics/gstreamer1-plugins-kms graphics/gstreamer1-plugins-jpeg graphics/gstreamer1-plugins-gl graphics/gstreamer1-plugins-gdkpixbuf graphics/gstreamer1-plugins-cairo graphics/gstreamer1-plugins-aalib graphics/gpaint graphics/goocanvasmm2 graphics/gnash graphics/gimmage graphics/gdk-pixbuf2-xlib graphics/gdk-pixbuf2 graphics/gdal graphics/fyre graphics/frogr graphics/flam3 graphics/evince graphics/eom (fails, itstool core dumps) graphics/eog-plugins graphics/elementary-photos graphics/digikam graphics/dia graphics/delaboratory graphics/dcmtk graphics/darktable graphics/cptutils graphics/cluttermm graphics/cegui graphics/cairomm graphics/blender (fails, unrelated) graphics/autopano-sift-c graphics/atril-lite graphics/atril graphics/aseprite graphics/art graphics/aeskulap graphics/ImageMagick7 graphics/ImageMagick6 graphics/GraphicsMagick games/xmoto games/tuxtype games/tali games/quadrapassel games/py-pychess games/openlierox games/netradiant games/naev games/mt_gtk_client games/mt_dolphin_ia games/manaplus games/maitretarot games/lordsawar games/lincity-ng games/lightsoff games/libmt_client games/libmaitretarot games/kanatest games/hitori games/gtkradiant games/gtkevemon games/gtkatlantic games/gnome-tetravex games/gnome-robots games/gnome-nibbles games/gnome-mahjongg games/gnome-klotski games/gnome-chess games/gnome-2048 games/freedoko games/four-in-a-row games/el games/armagetronad games/aisleriot games/0ad ftp/gstreamer1-plugins-curl ftp/R-cran-RCurl french/verbiste finance/quickfix finance/odoo15 (fails, unrelated) finance/odoo14 (fails, unrelated) finance/odoo finance/libofx finance/grisbi finance/gnucash emulators/virtualbox-ose-nox11-legacy emulators/virtualbox-ose-nox11 emulators/virtualbox-ose-legacy emulators/virtualbox-ose emulators/tiemu3 emulators/snes9x-gtk emulators/qemu-powernv emulators/qemu-cheri emulators/open-vm-tools emulators/nemu emulators/higan emulators/fuse emulators/catapult editors/xmlcopyeditor editors/xed editors/vscode editors/setzer editors/quilter editors/pluma-plugins (fails, unrelated) editors/pluma editors/openoffice-devel editors/openoffice-4 editors/mousepad editors/morla editors/marker editors/libreoffice editors/jucipp editors/gummi editors/gobby editors/gnome-text-editor editors/gnome-latex editors/ghex editors/gedit-plugins editors/gedit editors/emacs-devel editors/emacs editors/elementary-code editors/diamond editors/abiword dns/opendnssec2 dns/bind918 dns/bind916 dns/bind9-devel dns/bind-tools devel/zapcc devel/z88dk devel/xfce4-dev-tools devel/xdg-user-dirs devel/wf-config devel/universal-ctags devel/umbrello devel/ticcutils devel/tclxml devel/sope2 devel/sope devel/smooth devel/shiboken6 devel/shiboken2 devel/root (skipped due to databases/xrootd, unrelated) devel/regexxer devel/py-lxml devel/py-libpeas devel/pcsc-cyberjack devel/msitools devel/m17n-lib devel/llvm14 devel/llvm13 devel/llvm12 devel/llvm11 devel/llvm10 devel/llvm-devel devel/libvirt-glib devel/libvirt devel/libsoup3 devel/libsoup devel/libsmpp34 devel/librest devel/librcc devel/libqb devel/libplist devel/libpeas devel/libosinfo devel/libnotify devel/liblangtag devel/libiqxmlrpc devel/libical devel/libgsf devel/libgnt devel/libglademm24 devel/libglade2 devel/libght devel/libgdata devel/libdbusmenu devel/libdatovka devel/libdap devel/libassetml devel/libaravis devel/libabigail devel/kf6-kio devel/kf6-kdoctools devel/kf5-kio devel/kf5-kdoctools devel/hwloc2 devel/hwloc devel/gvfs devel/gtranslator devel/gstreamer1-plugins-soup devel/goffice devel/gnome-builder devel/glib20 devel/gitg devel/geany-plugin-pretty-printer devel/gconfmm26 devel/gconf2 devel/electron28 devel/electron27 devel/electron26 devel/electron25 devel/dia2code+ devel/dia2code devel/dconf devel/csoap devel/creduce devel/compiz-bcop devel/collada-dom devel/autogen devel/appstream-qt devel/appstream-glib devel/appstream-compose devel/appstream devel/anjuta devel/aegis deskutils/xpad deskutils/xfce4-tumbler deskutils/virt-manager deskutils/sysctlview deskutils/synapse deskutils/subsurface deskutils/rubrica deskutils/recoll deskutils/py-autokey deskutils/pinot deskutils/notekit deskutils/iconbrowser deskutils/gxneur deskutils/growl-for-linux deskutils/gnotime deskutils/gnote deskutils/gnome-tweaks deskutils/gnome-todo deskutils/gnome-photos deskutils/gnome-maps deskutils/gnome-dictionary deskutils/gnome-contacts deskutils/gnome-calendar deskutils/genius deskutils/elementary-calendar deskutils/easystroke deskutils/cherrytree deskutils/cairo-dock-plugins deskutils/cairo-dock deskutils/bookworm deskutils/bijiben deskutils/alarm-clock-applet databases/xrootd databases/sqliteodbc databases/spatialite_gui databases/spatialite-tools databases/spatialite databases/sequeler databases/rrdtool databases/qof databases/postgresql16-contrib databases/postgresql15-contrib databases/postgresql14-contrib databases/postgresql13-contrib databases/postgresql12-contrib databases/postgis34 databases/postgis33 databases/postgis32 databases/postgis31 databases/pointcloud databases/pgmodeler databases/pgbackrest databases/pgadmin3 databases/mariadb106-server databases/mariadb105-server databases/mariadb1011-server databases/libgdamm5 databases/libgda5-ui databases/libgda5-postgresql databases/libgda5-mysql databases/libgda5-ldap databases/libgda5-jdbc databases/libgda5 databases/gmdb2 databases/evolution-data-server databases/akonadi converters/xml2c comms/xastir comms/suscan comms/sigdigger comms/hamlib comms/gstreamer1-plugins-spandsp comms/gnocky chinese/fcitx cad/solvespace cad/repsnapper cad/pcb-rnd cad/oregano cad/openvsp cad/openscad-devel cad/openscad cad/opencascade cad/ifcopenshell (fails, marked BROKEN) cad/horizon-eda biology/sra-tools biology/ncbi-vdb biology/libsedml biology/libsbml biology/libnuml biology/libcombine audio/zrythm audio/vst3sdk audio/triceratops-lv2 audio/soundtracker audio/rhythmbox audio/qtractor audio/psindustrializer audio/pavucontrol audio/patchage audio/paprefs audio/owntone audio/muse-sequencer audio/mate-media audio/libmusicbrainz5 audio/libgpod audio/lash audio/ladish audio/kid3 audio/jalv-select audio/jalv audio/ices audio/icecast-kh audio/icecast audio/guitarix-lv2 audio/gtkpod audio/gtkguitune audio/gstreamer1-plugins-webrtcdsp audio/gstreamer1-plugins-wavpack audio/gstreamer1-plugins-vorbis audio/gstreamer1-plugins-twolame audio/gstreamer1-plugins-taglib audio/gstreamer1-plugins-speex audio/gstreamer1-plugins-soundtouch audio/gstreamer1-plugins-sndfile audio/gstreamer1-plugins-sidplay audio/gstreamer1-plugins-shout2 audio/gstreamer1-plugins-pulse audio/gstreamer1-plugins-opus audio/gstreamer1-plugins-openmpt audio/gstreamer1-plugins-ogg audio/gstreamer1-plugins-musepack audio/gstreamer1-plugins-mpg123 audio/gstreamer1-plugins-modplug audio/gstreamer1-plugins-lv2 audio/gstreamer1-plugins-lame audio/gstreamer1-plugins-ladspa audio/gstreamer1-plugins-jack audio/gstreamer1-plugins-gsm audio/gstreamer1-plugins-gme audio/gstreamer1-plugins-flite audio/gstreamer1-plugins-flac audio/gstreamer1-plugins-faad audio/gstreamer1-plugins-faac audio/gstreamer1-plugins-chromaprint audio/gstreamer1-plugins-cdparanoia audio/gstreamer1-plugins-bs2b audio/gstreamer1-plugins-amrwbdec audio/gstreamer1-plugins-amrnb audio/gstreamer1-plugins-a52dec audio/gsequencer audio/gnaural audio/ganv audio/ezstream audio/eq10q-lv2 audio/easytag audio/denemo audio/ario audio/ardour audio/aqualung audio/abgate-lv2 astro/gpscorrelate astro/foxtrotgps archivers/xar archivers/file-roller accessibility/caribou accessibility/at-spi2-core Build: https://pdr2.bofh.network/build.html?mastername=140-diizzy&build=2024-02-06_17h17m28s
Hi, I'd like to request an exp-run Best regards, Daniel
Exp-run looks fine
Ship it!
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=195a96e9cc459c653129b45b1c2934d3d059ad6b commit 195a96e9cc459c653129b45b1c2934d3d059ad6b Author: Daniel Engberg <diizzy@FreeBSD.org> AuthorDate: 2024-02-23 17:48:38 +0000 Commit: Daniel Engberg <diizzy@FreeBSD.org> CommitDate: 2024-02-23 17:48:43 +0000 textproc/libxml2: Update to 2.11.7 Fixes CVE-2024-25062 Reference: https://www.cve.org/CVERecord?id=CVE-2024-25062 Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7 PR: 276900 Approved by: desktop (fluffy) Sponsored by: Blinkinblox Exp-run by: antoine textproc/libxml2/Makefile | 2 +- textproc/libxml2/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
antoine, thanks for the exp-run!