| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-fix-autoconf-automake.patch | fix autoconf automake | Aron Xu <aron@debian.org> | no | 2012-10-03 | ||
| 0002-Make-generate-id-deterministic.patch | Make generate-id deterministic | Daniel Veillard <veillard@redhat.com> | yes | debian upstream | upstream, https://bugzilla.gnome.org/attachment.cgi?id=306475 | 2017-10-29 |
| 0003-remove-plugin-in-xslt-config.patch | remove-plugin-in-xslt-config Done in Debian upload 1.1.29-1 |
YunQiang Su <syq@debian.org> | no | 2017-10-29 | ||
| 0004-do-not-clean-manpage.patch | use the just-built xsltproc and the packaged stylesheet to rebuild the manpage if needed | Mattia Rizzolo <mattia@debian.org> | no | debian | 2020-03-04 | |
| 0005-Drop-libdir-and-static-linking-information-from-xslt.patch | Drop libdir and static linking information from xslt-config See https://bugs.debian.org/952115 for the static linking details. |
Mattia Rizzolo <mattia@debian.org> | no | debian | 2020-03-04 | |
| 0006-Fix-use-after-free-in-xsltApplyTemplates.patch | Fix use-after-free in xsltApplyTemplates xsltApplyTemplates without a select expression could delete nodes in the source document. 1. Text nodes with strippable whitespace Whitespace from input documents is already stripped, so there's no need to strip it again. Under certain circumstances, xsltApplyTemplates could be fooled into deleting text nodes that are still referenced, resulting in a use-after-free. 2. The DTD The DTD was only unlinked, but there's no good reason to do this just now. Maybe it was meant as a micro-optimization. 3. Unknown nodes Useless and dangerous as well, especially with XInclude nodes. See https://gitlab.gnome.org/GNOME/libxml2/-/issues/268 Simply stop trying to uselessly delete nodes when applying a template. This part of the code is probably a leftover from a time where xsltApplyStripSpaces wasn't implemented yet. Also note that xsltApplyTemplates with a select expression never tried to delete nodes. Also stop xsltDefaultProcessOneNode from deleting nodes for the same reasons. This fixes CVE-2021-30560. |
Nick Wellnhofer <wellnhofer@aevum.de> | no | https://gitlab.gnome.org/GNOME/libxslt/commit/50f9c9cd3b7dfe9b3c8c795247752d1fdcadcac8 | 2021-06-12 |