xmllint --xinclude --postvalid broken by CVE-2014-0191 fix

[Philip Olson]

The fix for CVE-2014-0191 changed the parser to not load external entities unless in noent or validating mode. Unfortunately, this breaks "xmllint --xinclude --postvalid" when (for example) validating docbook files, and as a result this breaks the build for a number of distro packages.

I stole this report from the Gentoo bug database, but it also applies to Ubuntu. The related bug reports:

Gentoo:
https://bugs.gentoo.org/show_bug.cgi?id=510508
  - libxml2-2.9.1-r3 fails
  - libxml2-2.9.1-r4 works

Upstream, includes patch:
https://bugzilla.gnome.org/show_bug.cgi?id=730290

Ubuntu package:
  - 2.9.1+dfsg1-3ubuntu4 works
  - 2.9.1+dfsg1-3ubuntu4.1 fails

Temporary solution is to downgrade:
  - apt-get install libxml2-dev=2.9.1+dfsg1-3ubuntu4 libxml2=2.9.1+dfsg1-3ubuntu4

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Philip Olson (philip-z)]

Here's OpenSUSE's fix:
  - Report: https://bugzilla.novell.com/show_bug.cgi?id=876652#c23
  - Confirmed fix: https://bugzilla.novell.com/show_bug.cgi?id=876652#c37