libxml2: fix CVE-2015-7942 and CVE-2015-8035

From: Armin Kuster <[email protected]>

CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections() CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled

[YOCTO #8641]

---
 meta/recipes-core/libxml/libxml2.inc               |  2 +
 .../libxml/libxml2/CVE-2015-7942.patch             | 55 ++++++++++++++++++++++
 .../libxml/libxml2/CVE-2015-8035.patch             | 41 ++++++++++++++++
 3 files changed, 98 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-7942.patch
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2015-8035.patch

index 1c3c37d..6ada401 100644
@@ -21,6 +21,8 @@ SRC_URI = "ftp://xmlsoft.org/libxml2/libxml2-${PV}.tar.gz;name=libtar \
            file://libxml-m4-use-pkgconfig.patch \
            file://configure.ac-fix-cross-compiling-warning.patch \
            file://0001-CVE-2015-1819-Enforce-the-reader-to-run-in-constant-.patch \
+           file://CVE-2015-7942.patch \
+           file://CVE-2015-8035.patch \
           "
 
 BINCONFIG = "${bindir}/xml2-config"

2.3.5

This should be Upstream-Status, to get this merged sooner rather than later I've fixed it when merging to my staging branch.

Ross

thanks.

- armin