package/libxslt: add upstream security fix for CVE-2019-11068
authorPeter Korsgaard <peter@korsgaard.com>
Wed, 24 Apr 2019 13:37:18 +0000 (15:37 +0200)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Wed, 24 Apr 2019 19:16:25 +0000 (21:16 +0200)
commit73edd3c21c8cd8610ade16f449e7af8fd60b8aa9
tree7272408e9cd2a8a9837cbdbdcb6b8e771c1a01d7
parent707529b7f7d7a80018cae5fec795dd36cc06fa8f
package/libxslt: add upstream security fix for CVE-2019-11068

Fixes the following security issue:

- CVE-2019-11068: libxslt through 1.1.33 allows bypass of a protection
  mechanism because callers of xsltCheckRead and xsltCheckWrite permit
  access even upon receiving a -1 error code.  xsltCheckRead can return -1
  for a crafted URL that is not actually invalid and is subsequently loaded.

Upstream bugtracker issue not yet public:
https://gitlab.gnome.org/GNOME/libxslt/issues/12

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/libxslt/0001-Fix-security-framework-bypass.patch [new file with mode: 0644]