Index: head/textproc/libxslt/Makefile =================================================================== --- head/textproc/libxslt/Makefile (revision 402100) +++ head/textproc/libxslt/Makefile (revision 402101) @@ -1,60 +1,60 @@ # Created by: Ade Lovett # $FreeBSD$ PORTNAME= libxslt PORTVERSION= 1.1.28 -PORTREVISION?= 7 +PORTREVISION?= 8 CATEGORIES?= textproc gnome MASTER_SITES= ftp://xmlsoft.org/libxml2/ \ http://xmlsoft.org/sources/ \ ftp://gd.tuwien.ac.at/pub/libxml/ DIST_SUBDIR= gnome2 MAINTAINER?= gnome@FreeBSD.org COMMENT?= The XSLT C library for GNOME .if !defined(REFERENCE_PORT) USES+= cpe gmake libtool pathfix CPE_VENDOR= xmlsoft GNU_CONFIGURE= yes INSTALL_TARGET= install-strip USE_LDCONFIG= yes USE_GNOME?= libxml2 CONFIGURE_ARGS?=--with-html-dir=${PREFIX}/share/doc \ --without-python CPPFLAGS+= -I${LOCALBASE}/include LDFLAGS+= -L${LOCALBASE}/lib LICENSE= MIT .if defined(MASTERDIR) _SLAVE_PORT= yes .else OPTIONS_DEFINE= MEM_DEBUG CRYPTO OPTIONS_DEFAULT=CRYPTO MEM_DEBUG_DESC= Enable memory debugging CRYPTO_DESC= Enable crypto support for exslt .endif MEM_DEBUG_CONFIGURE_ON= --with-mem-debug CRYPTO_CONFIGURE_WITH= crypto CRYPTO_LIB_DEPENDS= libgcrypt.so:${PORTSDIR}/security/libgcrypt post-patch: @${REINPLACE_CMD} -e '/^install-data-am:/ s|install-data-local||' \ ${WRKSRC}/doc/Makefile.in @${REINPLACE_CMD} -e 's|[$$](bindir)/xsltproc|../xsltproc/xsltproc|g ; \ s|[$$](bindir)/xmllint|../xmllint/xmllint|g' \ ${WRKSRC}/doc/Makefile.in .if !defined(MASTERDIR) post-stage: ${LN} -s libxslt.so.1 ${STAGEDIR}${PREFIX}/lib/libxslt.so.2 ${LN} -s libexslt.so.0 ${STAGEDIR}${PREFIX}/lib/libexslt.so.8 .endif .include .endif Index: head/textproc/libxslt/files/patch-CVE-2015-7995 =================================================================== --- head/textproc/libxslt/files/patch-CVE-2015-7995 (nonexistent) +++ head/textproc/libxslt/files/patch-CVE-2015-7995 (revision 402101) @@ -0,0 +1,29 @@ +From 7ca19df892ca22d9314e95d59ce2abdeff46b617 Mon Sep 17 00:00:00 2001 +From: Daniel Veillard +Date: Thu, 29 Oct 2015 19:33:23 +0800 +Subject: Fix for type confusion in preprocessing attributes + +CVE-2015-7995 http://www.openwall.com/lists/oss-security/2015/10/27/10 +We need to check that the parent node is an element before dereferencing +its namespace +--- + libxslt/preproc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libxslt/preproc.c b/libxslt/preproc.c +index 0eb80a0..7f69325 100644 +--- libxslt/preproc.c ++++ libxslt/preproc.c +@@ -2249,7 +2249,8 @@ xsltStylePreCompute(xsltStylesheetPtr style, xmlNodePtr inst) { + } else if (IS_XSLT_NAME(inst, "attribute")) { + xmlNodePtr parent = inst->parent; + +- if ((parent == NULL) || (parent->ns == NULL) || ++ if ((parent == NULL) || ++ (parent->type != XML_ELEMENT_NODE) || (parent->ns == NULL) || + ((parent->ns != inst->ns) && + (!xmlStrEqual(parent->ns->href, inst->ns->href))) || + (!xmlStrEqual(parent->name, BAD_CAST "attribute-set"))) { +-- +cgit v0.11.2 + Property changes on: head/textproc/libxslt/files/patch-CVE-2015-7995 ___________________________________________________________________ Added: fbsd:nokeywords ## -0,0 +1 ## +yes \ No newline at end of property Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/plain \ No newline at end of property