libexpat-devel-2.4.4-150400.3.12.1 >
A cYP?p9|ӡ tAKpJ\o֜Ktkf(M߁\љ
ҽqI98ed SoJu>kX
zTM?B* (Ь08ɜ&ec `oGBU>>ljY+&=+u&wjq J1hn/jo:sIk,"pME*~DmLΡ ڊWs%fQ_15a7da14b324864ae085c07e061c7ebe3121616e 472ef8113a0c5d2885a2a86a9be1e2c1692178edeaed706be6f35565605848c1 cYP?p9|4 :9|k,.νotĄ
v,cbZ/tֈ'흲w?%hS3" I8A?3 wa)TBjG3g.ZZcդ;['+\ ^pB[ ˱@zHVHR=B 1XzYX2!o̊zVU4;mweO%68fO+[oZ(s1[PyOV ~Pm3e|]ˌ`qR5<Êrو > p > i ? i d % X l p x | D Z
p
' ^ ( 8 " 9 @ " : " F eq G e H e I e X e Y e \ f$ ] fP ^ f b gN c g d hw e h| f h l h u h v h w i x iD y ip z ix i i i i C libexpat-devel 2.4.4 150400.3.12.1 Development files for expat, an XML parser toolkit Expat is an XML parser library written in C. It is a stream-oriented
parser in which an application registers handlers for things the
parser might find in the XML document (like start tags).
This package contains the development headers for the library found
in libexpat. cYPsheep02 1SUSE Linux Enterprise 15 SUSE LLC MIT https://www.suse.com/ Development/Libraries/C and C++ https://libexpat.github.io linux x86_64 B > 5 B
N AA큤 cYP cYP cYP cYP cYP cYP cYP cYP cYP cYP cYP c029131c3e490d352c83199976555308bc7998dacb42d25f451d1c79409227cb 815c23f8f20f1b983ca77897225a3e9f15ea23959ef96432b1ee508e49e25bf9 7ca9ed28dd5e08eac425931894fabd4c876db8f4be26f9b9a33c2e4f70a0d6c3 2fc1ba7fe83dcb3095f5f61312e665e24b52edbfd5a198210989607489a8ed1e 33708544410c5b5fc7d1a25d1700804719deb4e4cb57358d4d9d2e7328418bcb 23f4289da156adb6864628d633ae72599ac512f9301c20a6f899be70c5edde28 33f6a2347cbd45ba317bfe5c2d2c434cfd55624a96eb118797a4afbb8fb43edc c98d8cd77efcd7ba4e01136bc49b9d4a9fcee05a06befb99aadea9bebb1d6342 libexpat.so.1.8.4 root root root root root root root root root root root root root root root root root root root root root root expat-2.4.4-150400.3.12.1.src.rpm libexpat-devel libexpat-devel(x86-64) pkgconfig(expat) @
/usr/bin/pkg-config glibc-devel libexpat1 rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 2.4.4 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 cY!@c1@b#Pb~a a@aZ@aɪa7T@`@`@`u`lM@_y@]@]y@]o@]G@\\ \-@[@Z
}Z
}ZY@YYdY[@WW~W=2.4.5] Fix to CVE-2022-25236
breaks biboumi, ClairMeta, jxmlease, libwbxml,
openleadr-python, rnv, xmltodict
- Added expat-CVE-2022-25236-relax-fix.patch - Security fixes:
* (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
attackers to insert namespace-separator characters into
namespace URIs
- Added expat-CVE-2022-25236.patch
* (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
2.4.5 does not check whether a UTF-8 character is valid in a
certain context.
- Added expat-CVE-2022-25235.patch
* (CVE-2022-25313, bsc#1196168) Stack exhaustion in
build_model() via uncontrolled recursion
- Added expat-CVE-2022-25313.patch
- The fix upstream introduced a regression that was later
amended in 2.4.6 version
+ Added expat-CVE-2022-25313-fix-regression.patch
* (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
- Added expat-CVE-2022-25314.patch
* (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
- Added expat-CVE-2022-25315.patch - Update to latest version 2.4.4 in SLE-15-SP4 [jsc#SLE-21253] - update to 2.4.4 (bsc#1195217, bsc#1195054):
* Security fixes:
- CVE-2022-23852 -- Fix signed integer overflow
(undefined behavior) in function XML_GetBuffer
that is also called by function XML_Parse internally)
for when XML_CONTEXT_BYTES is defined to >0 (which is both
common and default).
Impact is denial of service or more.
- CVE-2022-23990 -- Fix unsigned integer overflow in function
doProlog triggered by large content in element type
declarations when there is an element declaration handler
present (from a prior call to XML_SetElementDeclHandler).
Impact is denial of service or more.
* Bug fixes:
- xmlwf: Fix a memory leak on output file opening error
* Other changes:
- Version info bumped from 9:3:8 to 9:4:8;
see https://verbump.de/ for what these numbers do
* Drop unused file valid-xhtml10.png - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474,
bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480):
* CVE-2021-45960 -- Fix issues with left shifts by >=29 places
resulting in
a) realloc acting as free
b) realloc allocating too few bytes
c) undefined behavior
depending on architecture and precise value
for XML documents with >=2^27+1 prefixed attributes
on a single XML tag a la
""
where XML_ParserCreateNS is used to create the parser
(which needs argument "-n" when running xmlwf).
Impact is denial of service, or more.
* CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow
on variable m_groupSize in function doProlog leading
to realloc acting as free.
Impact is denial of service or more.
* CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows
near memory allocation at multiple places. Mitre assigned
a dedicated CVE for each involved internal C function:
- CVE-2022-22822 for function addBinding
- CVE-2022-22823 for function build_model
- CVE-2022-22824 for function defineAttribute
- CVE-2022-22825 for function lookup
- CVE-2022-22826 for function nextScaffoldPart
- CVE-2022-22827 for function storeAtts
Impact is denial of service or more. - update to 2.4.2:
* Link againgst libm for function "isnan"
* Include expat_config.h as early as possible
* Autotools: Include files with release archives:
- buildconf.sh
- fuzz/*.c
* Autotools: Sync CMake templates
* docs: Document that function XML_GetBuffer may return NULL
when asking for a buffer of 0 (zero) bytes size
* docs: Fix return value docs for both
XML_SetBillionLaughsAttackProtection* functions
* Version info bumped from 9:1:8 to 9:2:8 - Update to 2.4.1 in SLE-15-SP4 [jsc#SLE-21253]
* Remove expat-CVE-2018-20843.patch upstream - Update to 2.4.1:
* Bug fixes:
- Autotools: Fix installed header expat_config.h for multilib
systems; regression introduced in 2.4.0 by pull request #486
* Other changes:
- Version info bumped from 9:0:8 to 9:1:8; see
https://verbump.de/ for what these numbers do - Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"]
* Security fixes:
- CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks
(denial-of-service; flavors targeting CPU time or RAM or both,
leveraging general entities or parameter entities or both)
by tracking and limiting the input amplification factor
( := ( + ) / ).
By conservative default, amplification up to a factor of 100.0
is tolerated and rejection only starts after 8 MiB of output bytes
(= + ) have been processed.
The fix adds the following to the API:
- A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to
signals this specific condition.
- Two new API functions ..
- XML_SetBillionLaughsAttackProtectionMaximumAmplification and
- XML_SetBillionLaughsAttackProtectionActivationThreshold
.. to further tighten billion laughs protection parameters
when desired. Please see file "doc/reference.html" for details.
If you ever need to increase the defaults for non-attack XML
payload, please file a bug report with libexpat.
- Two new XML_FEATURE_* constants ..
- that can be queried using the XML_GetFeatureList function, and
- that are shown in "xmlwf -v" output.
- Two new environment variable switches ..
- EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and
- EXPAT_ENTITY_DEBUG=(0|1)
.. for runtime debugging of accounting and entity processing.
Specific behavior of these values may change in the future.
- Two new command line arguments "-a FACTOR" and "-b BYTES"
for xmlwf to further tighten billion laughs protection
parameters when desired.
If you ever need to increase the defaults for non-attack XML
payload, please file a bug report with libexpat.
* Bug fixes:
- For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake)
or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault
for UTF-16 payloads containing CDATA sections.
- Autotools: Fix generated CMake files for non-64bit and
non-Linux platforms (e.g. macOS and MinGW in particular)
that were introduced with release 2.3.0
* Other changes:
- xmlwf: Improve help output and the xmlwf man page
- xmlwf: Improve maintainability through some refactoring
- xmlwf: Fix man page DocBook validity
- CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR
and CMAKE_INSTALL_INCLUDEDIR
- CMake: Add support for standard variable BUILD_SHARED_LIBS
- Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters
- Resolve macro HAVE_EXPAT_CONFIG_H
- Delete unused legacy helper file "conftools/PrintPath"
- doc/reference.html: Fix XHTML validity
- doc/reference.html: Replace the 90s look by OK.css
- Version info bumped from 8:0:7 to 9:0:8 due to addition of
new symbols and error codes; see https://verbump.de/ for
what these numbers do - Do not BuildRequire cmake: expat is part of the distro bootstrap
cycle and any additional dependency makes the ring larger. In
this case here, cmake was even only used to own a directory. - update to 2.3.0:
* When calling XML_ParseBuffer without a prior successful call to
XML_GetBuffer as a user, no longer trigger undefined behavior
(by adding an integer to a NULL pointer) but rather return
XML_STATUS_ERROR and set the error code to (new) code
XML_ERROR_NO_BUFFER. Found by UBSan (UndefinedBehaviorSanitizer)
of Clang 11 (but not Clang 9).
* xmlwf: Exit status 2 was used for both:
- malformed input files (documented) and
- invalid command-line arguments (undocumented).
case of invalid command-line arguments now
has its own exit status 4, resolving the ambiguity.
* Other changes - Update to 2.2.10:
* Bug fixes:
- Fix undefined behavior during parsing caused by pointer
arithmetic with NULL pointers
- Fix reading uninitialized variable during parsing
- xmlwf: Add missing check for malloc NULL return
* Other changes:
- xmlwf: Document exit codes in xmlwf manpage and exit with code 3
(rather than code 1) for output errors when used with "-d DIRECTORY"
- Autotools: Use -Werror while configure tests the compiler for
supported compile flags to avoid false positives
- Autotools: Improve handling of user (C|CPP|CXX|LD)FLAGS, e.g.
ensure that they have the last word over flags added while
running ./configure
- CMake: Create libexpatw.{dll,so} and expatw.pc (with emphasis
on suffix "w") with -DEXPAT_CHAR_TYPE=(ushort|wchar_t)
- CMake: Detect and deny unsupported build combinations
involving -DEXPAT_CHAR_TYPE=(ushort|wchar_t)
- CMake: Install pre-compiled shipped xmlwf.1 manpage in case
of -DEXPAT_BUILD_DOCS=OFF
- CMake: Fix use of Expat by means of add_subdirectory
- CMake: Keep expat target name constant at "expat" (i.e. refrain
from using the target name to control build artifact filenames)
- CMake: Expose man page compilation as target "xmlwf-manpage"
- CMake: Introduce option EXPAT_BUILD_PKGCONFIG to control
generation of pkg-config file "expat.pc"
- CMake: Add minimalistic support for building binary packages
with CMake target "package"; based on CPack
- CMake: Add option -DEXPAT_OSSFUZZ_BUILD=(ON|OFF) with default
OFF to build fuzzer code against OSS-Fuzz and related
environment variable LIB_FUZZING_ENGINE
- Fix testsuite for -DEXPAT_DTD=OFF and -DEXPAT_NS=OFF
- Address compiler warnings
- Address pngcheck warnings with doc/*.png images: Version info
bumped from 7:11:6 to 7:12:6 - Version update to 2.2.9
* Other changes:
- examples: Drop executable bits from elements.c
[#349] Windows: Change the name of the Windows DLLs from expat*.dll
to libexpat*.dll once more (regression from 2.2.8, first
fixed in 1.95.3, issue #61 on SourceForge today,
was issue #432456 back then); needs a fix due
case-insensitive file systems on Windows and the fact that
Perl's XML::Parser::Expat compiles into Expat.dll.
[#347] Windows: Only define _CRT_RAND_S if not defined
Version info bumped from 7:10:6 to 7:11:6 - Version update to 2.2.8
* Security fixes: (CVE-2019-15903, bsc#1149429)
- CVE-2019-15903 -- Fix heap overflow triggered by XML_GetCurrentLineNumber
(or XML_GetCurrentColumnNumber), and deny internal entities closing the doctype;
* Bug fixes:
- Fix cases where XML_StopParser did not have any effect
when called from inside of an end element handler
- xmlwf: Fix exit code for operation without "-d DIRECTORY";
previously, only "-d DIRECTORY" would give you a proper exit code:
Now both cases return exit code 2.
* Other changes:
- examples: Improve elements.c
- Autotools: Add argument --enable-xml-attr-info
- Autotools: Add arguments --with-getrandom --without-getrandom --with-sys-getrandom --without-sys-getrandom
- Autotools: Fix linking issues with "./configure LD=clang"
- Autotools: Fix "make run-xmltest" for out-of-source builds
- CMake: Pull all options from Expat <=2.2.7 into namespace
- CMake: Add argument -DEXPAT_ATTR_INFO=(ON|OFF), default OFF
- CMake: Add argument -DEXPAT_LARGE_SIZE=(ON|OFF), default OFF
- CMake: Add argument -DEXPAT_MIN_SIZE=(ON|OFF), default OFF
- CMake: Add arguments -DEXPAT_WITH_GETRANDOM=(ON|OFF|AUTO), default AUTO
- CMake: Add arguments -DEXPAT_WITH_SYS_GETRANDOM=(ON|OFF|AUTO), default AUTO
- CMake: Install expat_config.h to include directory
- CMake: Generate and install configuration files for future find_package(expat [..] CONFIG [..])
- CMake: Now produces a summary of applied configuration
- CMake: Require C++ compiler only when tests are enabled
- CMake: Fix compilation for 16bit character types, i.e. ex -DXML_UNICODE=ON (and ex -DXML_UNICODE_WCHAR_T=ON)
- CMake: Port "make run-xmltest" from GNU Autotools to CMake
- CMake: Integrate OSS-Fuzz fuzzers, option -DEXPAT_BUILD_FUZZERS=(ON|OFF), default OFF
- Removed patches fixed in the update:
* expat-CVE-2019-15903.patch
* expat-CVE-2019-15903-tests.patch - Security fix (CVE-2019-15903, bsc#1149429)
* Crafted XML input results in heap-based buffer over-read by fooling
the parser into changing from DTD parsing to document parsing
* Added patches:
- expat-CVE-2019-15903.patch
- expat-CVE-2019-15903-tests.patch - Version update to 2.2.7 (CVE-2018-20843, bsc#1139937)
* Security fixes:
- CVE-2018-20843 - Fix extraction of namespace prefixes from
XML names; XML names with multiple colons could end up in
the wrong namespace, and take a high amount of RAM and CPU
resources while processing, opening the door to use for
denial-of-service attacks
* Other changes:
- Autotools/CMake: Utilize -fvisibility=hidden to stop
exporting non-API symbols
- Autotools: Add --without-examples and --without-tests
- Autotools: Modernize configure.ac
- Autotools: Fix check for -fvisibility=hidden for Clang
- Autotools: Fix compilation for lack of docbook2x-man
- CMake: Make libdir of pkgconfig expat.pc support multilib
- CMake: Build man page in PROJECT_BINARY_DIR not _SOURCE_DIR
- Remove fallback to bcopy, assume that memmove(3) exists
- Removed expat-2.2.6-fix-make-clean.patch - Add expat-2.2.6-fix-make-clean.patch
- Allow profile guided optimization again - Drop docbook2x dependency, the manpages are generated in
the upstream archive and this way we break buildcycle - Version update to 2.2.6 Sun August 12 2018
* Bug fixes:
- Avoid doing arithmetic with NULL pointers in XML_GetBuffer
- Fix 2.2.5 regression with suspend-resume while parsing
a document like ''
* Other changes:
- Autotools: Fix docbook-related configure syntax error
- Autotools: Avoid grep option `-q` for Solaris
- Autotools: Support
./configure DOCBOOK_TO_MAN="xmlto man --skip-validation"
- Autotools: Support DOCBOOK_TO_MAN command which produces
xmlwf.1 rather than XMLWF.1; also covers case insensitive
file systems
- Autotools: Drop -rpath option passed to libtool
- Autotools: Detect and deny SGML docbook2man as ours is XML
- Autotools/CMake: Support command db2x_docbook2man as well
- CMake: Introduce option WARNINGS_AS_ERRORS, defaults to OFF
- CMake: Introduce option MSVC_USE_STATIC_CRT, defaults to OFF
- CMake: Introduce option XML_UNICODE and XML_UNICODE_WCHAR_T,
both defaulting to OFF
- CMake: Prefer check_symbol_exists over check_function_exists
- CMake: Create the same pkg-config file as with GNU Autotools
- CMake: Use GNUInstallDirs module to set proper defaults for
install directories
- CMake: Utilize expat_config.h.cmake for XML_DEV_URANDOM
- Address compiler warnings
- Fix miscellaneous typos - Expand description of expat-devel. - Do not generate manpages from docbook
- Temporarily disable profiling due to bug in build system - Version update to 2.2.5 Tue October 31 2017
* Bug fixes:
- If the parser runs out of memory, make sure its internal
state reflects the memory it actually has, not the memory
it wanted to have.
- The default handler wasn't being called when it should for
a SYSTEM or PUBLIC doctype if an entity declaration handler
was registered.
- Fix a case of mistakenly reported parsing success where
XML_StopParser was called from an element handler
- Function XML_ErrorString was returning NULL rather than
a message for code XML_ERROR_INVALID_ARGUMENT
introduced with release 2.2.1
* Other changes:
- Add argument -N adding notation declarations
- various compiler-specific fixes
- Improve docbook2x-man detection
- drop expat-docbook.patch
* fixed in 0f5186c7b8e503c669e332d944712de010b265f3
- switch to github for release tarballs and website - Version update to 2.2.4 Sat August 19 2017
* Bug fixes:
[#115] Fix copying of partial characters for UTF-8 input
* Other changes:
[#109] Fix "make check" for non-x86 architectures that default
to unsigned type char (-128..127 rather than 0..255)
[#109] coverage.sh: Cover -funsigned-char
Autotools: Introduce --without-xmlwf argument
[#65] Autotools: Replace handwritten Makefile with GNU Automake
[#43] CMake: Auto-detect high quality entropy extractors, add new
option USE_libbsd=ON to use arc4random_buf of libbsd
[#74] CMake: Add -fno-strict-aliasing only where supported
[#114] CMake: Always honor manually set BUILD_* options
[#114] CMake: Compile man page if docbook2x-man is available, only
[#117] Include file tests/xmltest.log.expected in source tarball
(required for "make run-xmltest")
[#111] Fix some typos in documentation
Version info bumped from 7:5:6 to 7:6:6
- Release 2.2.3 Wed August 2 2017
* Bug fixes:
[#85] Fix a dangling pointer issue related to realloc
* Other changes:
[#91] Linux: Allow getrandom to fail if nonblocking pool has not
yet been initialized and read /dev/urandom then, instead.
This is in line with what recent Python does.
[#86] Check that a UTF-16 encoding in an XML declaration has the
right endianness
[#4] #5 #7 Recover correctly when some reallocations fail
Repair "./configure && make" for systems without any
provider of high quality entropy
and try reading /dev/urandom on those
Ensure that user-defined character encodings have converter
functions when they are needed
Fix mis-leading description of argument -c in xmlwf.1
Rely on macro HAVE_ARC4RANDOM_BUF (rather than __CloudABI__)
for CloudABI
[#100] Fix use of SIPHASH_MAIN in siphash.h
[#23] Test suite: Fix memory leaks
Version info bumped from 7:4:6 to 7:5:6
- Release 2.2.2 Wed July 12 2017
* Security fixes:
[#43] Protect against compilation without any source of high
quality entropy enabled, e.g. with CMake build system;
* [MOX-006] Fix non-NULL parser parameter validation in XML_Parse;
resulted in NULL dereference, previously;
* Bug fixes:
[#69] Fix improper use of unsigned long long integer literals
* Other changes:
[#73] Start requiring a C99 compiler
[#49] Fix "==" Bashism in configure script
[#58] Address compile warnings
[#68] Fix "./buildconf.sh && ./configure" for some versions
of Dash for /bin/sh
[#72] CMake: Ease use of Expat in context of a parent project
with multiple CMakeLists.txt files
[#72] CMake: Resolve mistaken executable permissions
[#76] Address compile warning with -DNDEBUG (not recommended!)
[#77] Address compile warning about macro redefinition
* Added patch expat-docbook.patch to compile the man pages with
docbook-to-man
* Cleaned spec file with spec-cleaner - Allow building when do_profiling is undefined - Build with profiling when possible - Version update to 2.2.1 Sat June 17 2017
- Security fixes:
CVE-2017-9233 / bsc#1047236 -- External entity infinite loop DoS
Details: https://libexpat.github.io/doc/cve-2017-9233/
Commit c4bf96bb51dd2a1b0e185374362ee136fe2c9d7f
- [MOX-002] CVE-2016-9063 / bsc#1047240 -- Detect integer overflow;
(Fixed version of existing downstream patches!)
- (SF.net) #539 Fix regression from fix to CVE-2016-0718 cutting off
longer tag names;
[#25] More integer overflow detection (function poolGrow);
- [MOX-002] Detect overflow from len=INT_MAX call to XML_Parse;
- [MOX-005] #30 Use high quality entropy for hash initialization:
* arc4random_buf on BSD, systems with libbsd
(when configured with --with-libbsd), CloudABI
* RtlGenRandom on Windows XP / Server 2003 and later
* getrandom on Linux 3.17+
In a way, that's still part of CVE-2016-5300.
https://github.com/libexpat/libexpat/pull/30/commits
- [MOX-005] For the low quality entropy extraction fallback code,
the parser instance address can no longer leak,
- [MOX-003] Prevent use of uninitialised variable; commit
- [MOX-004] a4dc944f37b664a3ca7199c624a98ee37babdb4b
Add missing parameter validation to public API functions
and dedicated error code XML_ERROR_INVALID_ARGUMENT:
- [MOX-006] * NULL checks; commits
* Negative length (XML_Parse); commit
- [MOX-002] 70db8d2538a10f4c022655d6895e4c3e78692e7f
- [MOX-001] #35 Change hash algorithm to William Ahern's version of SipHash
to go further with fixing CVE-2012-0876.
https://github.com/libexpat/libexpat/pull/39/commits
- Bug fixes:
[#32] Fix sharing of hash salt across parsers;
relevant where XML_ExternalEntityParserCreate is called
prior to XML_Parse, in particular (e.g. FBReader)
[#28] xmlwf: Auto-disable use of memory-mapping (and parsing
as a single chunk) for files larger than ~1 GB (2^30 bytes)
rather than failing with error "out of memory"
[#3] Fix double free after malloc failure in DTD code; commit
7ae9c3d3af433cd4defe95234eae7dc8ed15637f
[#17] Fix memory leak on parser error for unbound XML attribute
prefix with new namespaces defined in the same tag;
found by Google's OSS-Fuzz; commits
xmlwf on Windows: Add missing calls to CloseHandle
- New features:
[#30] Introduced environment switch EXPAT_ENTROPY_DEBUG=1
for runtime debugging of entropy extraction
Bump version info from 7:2:6 to 7:3:6 - Remove pointless --with-pic (for static only) - Version update to 2.2.0:
* Fixes bnc#983215 CVE-2012-6702
* Fixes bnc#983216 CVE-2016-5300
* Various cmake and autotools script updates
* Fix detection of utf8 character boundaries
- Remove all patches merged upstream:
* expat-2.1.1-avoid_relying_on_undef_behaviour.patch
* expat-2.1.1-parser_crashes_on_malformed_input.patch
* expat-alloc-size.patch
* expat-visibility.patch - add expat-2.1.1-avoid_relying_on_undef_behaviour.patch to avoid
relying on undefined behavior in the original CVE-2015-1283 fix
[bnc#980391], [bnc#983985], [CVE-2016-4472]
- add expat-2.1.1-parser_crashes_on_malformed_input.patch to fix
Expat XML parser that mishandles certain kinds of malformed input
documents [bnc#979441], [CVE-2016-0718]
- use spec-cleaner to clean specfile - After simplification of expat-visibility.patch, it became
uneffective as no symbols are getting hidden. add
- fvisibility=hidden to CFLAGS again.
- expat-alloc-size.patch: fix braino, realloc()-like functions
should not take __attribute__(malloc) - Update to version 2.1.1
* Fixes CVE-2015-1283 — Multiple integer overflows in the
XML_GetBuffer function
* Fix potential null pointer dereference
* Symbol XML_SetHashSalt was not exported
* Output of xmlwf -h was incomplete
* Document behavior of calling XML_SetHashSalt with salt 0
* Minor improvements to man page xmlwf(1)
- Simplify expat-visibility.patch, refresh expat-alloc-size.patch
- Drop config-guess-sub-update.patch, fixed upstream. - Cleanup spec file with spec-cleaner
- Remove old ppc obsoletes/provides sheep02 1666797588
2.4.4-150400.3.12.1 2.4.4-150400.3.12.1 2.4.4 expat.h expat_config.h expat_external.h cmake expat-2.4.4 expat-config-version.cmake expat-config.cmake expat-noconfig.cmake expat.cmake libexpat.so expat.pc /usr/include/ /usr/lib64/ /usr/lib64/cmake/ /usr/lib64/cmake/expat-2.4.4/ /usr/lib64/pkgconfig/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:26588/SUSE_SLE-15-SP4_Update/4859e402b2f138085e613b27f8fe8794-expat.SUSE_SLE-15-SP4_Update cpio xz 5 x86_64-suse-linux C source, UTF-8 Unicode text C source, ASCII text directory ASCII text pkgconfig file P R reuė!Ìol utf-8 b897a9edb798854cd97d182e3bab76b6105e9ac307d3867c345668c1bab0fbe2 ? 7zXZ
! t/?r]
crv(vX0 z*샠Z ( Vq
&^ lƭU#mѨ&0s yz5Vqͮ]kTܝR>L j>CW~ϠؽA
j xDTH-bfD_<|XuQ`j=_S}܊͈aqZSuL^aB7줕-_xȇG7/㗈0^ҙHr~p=^ZdeQU5k:Xƛr
0msҨD @ܟԎkkN X
ki]x2ɚv-DEN7QH4]?"&'nx" x|P{ |{[: 31
x99SdtR
B1Bi @"}{eXrJRW @ > ʙРTݡv F/"I7GDڔpbrx% k5Ӊux^:vG{)d;&;[DNneLjCṅ{d14 G 9.!>9Zߌ?N
8Un o7HK3@Gm^ ױzƓȿIz'rqCLYJf*a^կ*W;D% \|7vlDC@ cc4,F϶`ժ QbeD[ȓx`FTOBd
Pld>sGRc
gBh#D1d)߈r{آ@\x!WGVp]bRIG?tQY`ȃ-b&9mw`!
U_{. ?Gȣ;hp1]äBb k*,[uςG
eW7N8[Ni(54*cȜ '}qx>J ` OvCY:>㗍8#t>jxIm?/g{noǍI`] Has[G=-RX ՎtۦN^4맔օ F`
e`n&g1ڀcMi?/i%{:Za9nE>uFJiX&$Tr1oD=8b~ܬ`}D
jgF,<~M`%'ۉ
:S]UN[Ti lA`5RNyh&
_+ZY}CkF cfspRJPDQB,4͎P!r=YPi?eUD4l(kyէ s)rbqF \L#2p۱,{D?
K&T_M'/Z6*2BV(iHYW5jk52!gְ
Dxݧ}ywC[4ZHvҞmw5j[dd%1sZ13- ql. 1h w+7'Tor &l
?,!tEwo&Ul#3U/mJLlݎE3w ${k!$m8?_H>l?$g3ޅvJ>
LNpFEM@{fKtC )|i'b# SLuSK`Wn --*; '`89eJ
}l&8+gMUFl1gӂR'ԂbuB8bs&* ~\Zav57~_$=:@)="iwقZ&|#=Ch"q:e\ ^$ xtG+_TcIsMI:?xI![ӈ3yNIX#gk7nU?ȏ gHD `!@
n11 o7IגT1(w 5 m8|ɞ 2u `Ѯ& ] Vf\ۦ* FƄkj=SBl_ROk3rI9%YkG sӦd Y73*Y!FӆŜFAgŞU )~s9Jocp$np² Z̫EǚByGuǃ :(놈O%0<03god"ih'td[KY
|4/bk- 1m$*j&FkNi5 g1aOr#
z~O.ttUK Ш#N;&c
!ßk1X/
4+=[qc|a?`e ]ƐG"~DݗW<ɷgHƣh]kv6M2ͩ @U&NMcBRcJ k];G.'Π:+ &qO \2W+8|
6@ e5/ŋVǪ87 pM=|<@s *YIӏMۺ
AÀR9i *U]ZϜT54m-a}_Q>mZop$c9LBC} 8a 2b#k
1V_`R~C 2m`vJuWg?kC03"Ջ>M u Nc!6,Jb۬(,jXFF :f37G(FV mpr qL NZ2Sy5T# ECO`5
#5m5KB)$31E7 3P>-y"rX-Wg'v[)bQS*Rl@vSx ;Gbz M_3;0ƶq$@^5)
GK!z n
^a/j3'?q2ENe S_ZfgA3r
wƛw|}"HgW<#u㨆pKfiA]A#k*i+>IZ0ѰQE{+(/;}T25: vr'%I; [15.eMq%Շ"PK O;`
80q m( . j5'ԉ)5|9 /+vRpY\էj(bɼ]Dumdy7y[nQ7dW@ZtUwTKC *eo,[lhTZFYaU%) êẌ́%̻' n Rk*%~У≬ԡzŦ %?j|\#,nMQ7&GSMYZ[Ԇk*b,읬hnVU:A>6pZ-S^#N#EZQ}q
dO
AXyʮWHUNPlTGq[ C=X"L叿e nI[J#pMѨp W Oa&@+;]M)VZ !w&8@$S"лk#[E\z}AM F\[,(7k+ l 8##VhۺeԬ)?R8,s=I [t QPhj*(wP "#i՝7LJ`Z4M|&+%ُH$Z _T% _+`rπ@|3n:b욅8c d{EF}rj2oGl4=&i
h^wMjk;y(ڗ`<Li@P
ZM*[/"(ZdvE5!*ޠ'kDtt~UOr
T68wZP`i(KCχU"&sdB1촳"C
1 ]fe>xaq|A'S QN{hkǘh\ ^0gbH\M`]P$Hi| Yj 8lzqKL ,c`KZ1 Erv y#YIf=,@82{ʮk!cS=mHpoS|dzEbeF7UB7ҠnI 1È07d ^ܔ9 _ j8y{f| NlVӉً 7L4l#<.^Jl`Nk Ƒ]Oh%3#&=lIE$eI9.TT, \u#@VX<^E]`R }mܶu4S1I@ Iۡ(D?R[W
{deT "y:79MUH$b1==
\B37JwxEET(k$Q)
GSQY EYS
' (>(*-6j_ǭ@ 1K@,
b<ՆVNu+cƯY j*>y9.ۣ`ڪ`焞ǓelFt9/{/b9{۽ x# ](NNPxZ#-3%s߰Ȋ]kا;v0q?A)Z- \╤8
i˔g+ľ W#GaԢE ښ]&@eXy/:
Wi yi? nkv\} 8D^-c8x#/rFg&BNj(_^aXW
,GTlg ^a;0x:`ī]Es~z7 ؝M+5φ:
t dԻ@V\ 7=72'ǝێX] 8_ǡ7 :e~젊['%4"!u _uPjŇd$9{ +i)I
"ZqA$^ CC}`$R %<*K PpX I<> ?ce_M<-54r pvYiRHsXr+brt3/cG ??]THnLg;7|*IjU`%ÒWb(ʉdMn~>n: jXŊBE]K.'Jm#:܀ i
k肓Ԝz^T~ᮨ4)d `sT@ xiу1` jάetK/GPi)*Cyt
Y
Q*Ux c~6$:i JUWڃEz *9c^EJev.8] _bdAQ>,s'R$E ,l(k,Ȇ<}
ښ[J}_]A5C,Az WdL |\~.ֺ=n.AdUܯ蝍 R%|l
V"?2J)*v-jDDVeMO3&E/^`fŪX,(YcRVۆKeuN[M&`H*%bǪIco䲈 .*:2w[^7;wQS©Qa.8}9]HGV ܿW~%g?GQ+V嶍5W' ek05,%ZZ .
N;X;dcK L6Cgtt>k؆WϏOaCU~SsRri<!6Jmvo+ɯ}ZV$
ZڂݫK~JF2N vO<.vp?ygԪT"bM tK;R!>Z˛m)d~ ~ѣJ1ЮF>,Ė0éqbmv"T}|Bټ^ {c`hCe4M-SA~a\Ap
h.1)Qsq >{'[aL7B/$5&-|j&+SnhLlu$'T,#6*H¹yA.Xﯺ4X)`9f 9{c/akfl{vt*8t`OOV2Fg
1˘ȶcoٴ<= ANEXD%θ/4"^YUs+B2hI +,֨O#8!OrڳPh^y|Ӳ ~W!_az'^:
#dgT"9Rz颋+eacI2Oi ':0< s`rjY]Q ,P B^:t?ԭ 1] )+̣zz} _P{Me &
EYN0h{q@ %3?YJ$ 9]gȈ
"B/ &Ql'Wթ)Sz=ytP$!K irqi
|,m? cSryG럤WI-
u:Ά;6/ʪ Wkcum3ts j(y `\!58lY=R7Z42|- pFE.sfΞ /QBwxr dE ~苏([0 [Cx0 rp
R7|4 7 CFY sfk*Jٟ"; EEgB s6ф;~o>XKݜ}
w"%`5݃{EGN[ woZ;smk~ 5> Jf ̙8_x1 {pUvf#mHc=0G,U`~
ԅ]A7jU*5pz2YZyUv !=ֈe xIPc v;vS>k!pc?OpbTb$Nr!36c ءk` 4fI5br66 kPQ t"؟ּLmpmFjfPod8JS'粤K#eK,|(
'F~7$߿@=ie Em+8E
:przM}̉<2fsM*Gք<|O9~KlJAޜn8_Ք dhBgvIZ_&7gASafe %l*X _3ڲWhj`1BrFYe, ѠfEĭ@ h [a f6T@ "@8+^ߐ2>R Cn}˾
3yT߹ ܴi7* Jyi^) 4E/u[ Y 1-y`hr()~0OP/n62x{\By"O]H=̅P6_,HU`Y2;v\宽p ?)lxo'iJ|25\
B`ְK挤"nFY@H@U(%lfF BJ֬tPGg6H|u0bZʍ ϑ=1 ef, 7qlts$ vĸkI_Y(2yIqL͗Aeȃq%ǷG,|%-DsAt7Q+\B~5 GWgaI/2ݫ)"HΉW fyY]w6F8.H==~ӝ
K/b2e/t B2',N1}TD^A/~uG
﮵a> N25'J}=؉Gy9=բj@7pX,-){::&|Tx8}I~Si L3{}Vs{o&3"lț;( (z`_>(%{zoށ GGu*]5^wAGsRt9jQZ((SK Ts]dȉjFT6Eo:Q\̈́m /:"!͢i"'8Ձ7L/н58bm10O `> ?0/ӽj͔fN@:5ֹ!rgZ+#Z nfGP_[ ="\! z܌~:ᢛ "B9vb+L㟿
?u\>ɪdI!yFʢ#gډKK(IX;\R&Ǯ«[S߆Eyj{N #%᙮9p7ZҼ,A0; P ,1V T2tǵ׆W s δuB17QgT kr)uAljaj?) `r,Lu|&eZhm0i5hٺai7j4pn*H2ԋo65O/ {S;7*C˥Μ&x-
{iZ[Z N0@| ;z%8}(Ct2'.
=0%YAn<~~wc#g!{Y 3kJo !g)
A.:(ͷY=4ٯrd>s"i$h
38]< r0o/1GjFER$ҁ't~+ۄVpU(oSToaYAzz vN[Fifez,]^WobWZ~)'ppql /0A0ȩ3h $ψ^U;M8$ym01cL`+[yv({F:C\cHޥDa}B ͦk[~p2WDbSXƜe͟yO
E趫A'j7?60xmm-s
H2m"o)ti\2=Ni4FŃ(
4d|vvc4)8a2#1$>M kktnZjL-o42(0 @ʅ5 C -bs ;Ī>KvD,v7[ald!B8ҍ` ʽ; o~wmhT2W$#$^ ZAA )16WrT `b%D [ Qg^z, %j&^> gk?b)cRx F Nn=e u~1xY骜]ν$!.sk<,Z\&ɧV&H1e1:r(A |B^v@U9kO/8<|2y$bN,Ή,mrPVEG=9e 3 A}6Dn^1>/ #6
YZ