diff -u libxml2-2.7.8.dfsg/parser.c libxml2-2.7.8.dfsg/parser.c --- libxml2-2.7.8.dfsg/parser.c +++ libxml2-2.7.8.dfsg/parser.c @@ -2557,8 +2557,8 @@ xmlCharEncoding enc; /* - * Note: external parsed entities will not be loaded, it is - * not required for a non-validating parser, unless the + * Note: external parameter entities will not be loaded, it + * isnot required for a non-validating parser, unless the * option of validating, or substituting entities were * given. Doing so is far more secure as the parser will * only process data coming from the document entity by @@ -2567,6 +2567,7 @@ if ((entity->etype == XML_EXTERNAL_PARAMETER_ENTITY) && ((ctxt->options & XML_PARSE_NOENT) == 0) && ((ctxt->options & XML_PARSE_DTDVALID) == 0) && + ((ctxt->options & XML_PARSE_DTDLOAD) == 0) && (ctxt->validate == 0)) return; @@ -12382,6 +12383,9 @@ return(NULL); } + /* We are loading a DTD */ + ctxt->options = XML_PARSE_DTDLOAD; + /* * Set-up the SAX context */ diff -u libxml2-2.7.8.dfsg/debian/changelog libxml2-2.7.8.dfsg/debian/changelog --- libxml2-2.7.8.dfsg/debian/changelog +++ libxml2-2.7.8.dfsg/debian/changelog @@ -1,3 +1,12 @@ +libxml2 (2.7.8.dfsg-5.1ubuntu4.8) precise-security; urgency=medium + + * SECURITY REGRESSION: xmllint no longer loads entities with --postvalid + (LP: #1321869) + - Thanks to Alexey Neyman for proposed patch + - https://mail.gnome.org/archives/xml/2014-May/msg00003.html + + -- Marc Deslauriers Fri, 06 Jun 2014 12:32:11 -0400 + libxml2 (2.7.8.dfsg-5.1ubuntu4.7) precise-security; urgency=medium * SECURITY UPDATE: resource exhaustion via external parameter entities