diff -u libxml2-2.7.8.dfsg/parser.c libxml2-2.7.8.dfsg/parser.c --- libxml2-2.7.8.dfsg/parser.c +++ libxml2-2.7.8.dfsg/parser.c @@ -2558,7 +2558,7 @@ /* * Note: external parameter entities will not be loaded, it - * isnot required for a non-validating parser, unless the + * is not required for a non-validating parser, unless the * option of validating, or substituting entities were * given. Doing so is far more secure as the parser will * only process data coming from the document entity by @@ -2568,6 +2568,8 @@ ((ctxt->options & XML_PARSE_NOENT) == 0) && ((ctxt->options & XML_PARSE_DTDVALID) == 0) && ((ctxt->options & XML_PARSE_DTDLOAD) == 0) && + ((ctxt->options & XML_PARSE_DTDATTR) == 0) && + (ctxt->replaceEntities == 0) && (ctxt->validate == 0)) return; @@ -12256,6 +12258,9 @@ return(NULL); } + /* We are loading a DTD */ + ctxt->options |= XML_PARSE_DTDLOAD; + /* * Set-up the SAX context */ @@ -12384,7 +12389,7 @@ } /* We are loading a DTD */ - ctxt->options = XML_PARSE_DTDLOAD; + ctxt->options |= XML_PARSE_DTDLOAD; /* * Set-up the SAX context diff -u libxml2-2.7.8.dfsg/debian/changelog libxml2-2.7.8.dfsg/debian/changelog --- libxml2-2.7.8.dfsg/debian/changelog +++ libxml2-2.7.8.dfsg/debian/changelog @@ -1,3 +1,12 @@ +libxml2 (2.7.8.dfsg-5.1ubuntu4.9) precise-security; urgency=medium + + * SECURITY REGRESSION: more xmllint regressions (LP: #1321869) + - use upstream commit which includes additional regression fixes to + parser.c. + - https://git.gnome.org/browse/libxml2/commit/?id=dd8367da17c2948981a51e52c8a6beb445edf825 + + -- Marc Deslauriers Fri, 13 Jun 2014 09:11:38 -0400 + libxml2 (2.7.8.dfsg-5.1ubuntu4.8) precise-security; urgency=medium * SECURITY REGRESSION: xmllint no longer loads entities with --postvalid