Ubuntu
xmltooling package

  1. Bug #1752306
  2. Comment #13

Comment 13 for bug 1752306

Revision history for this message
Ray Link (rlink) wrote :

Debdiff attached which fixes the problem for Xenial.

Since there is no corresponding Debian release to fakesync this from for Xenial, I've just recreated the patch sequence against the version already in Xenial. It includes the same two quilt patches which have been fake-synced into Trusty, and already exist in Bionic:

- A one-line patch to add 'disallowDoctype' to the parser configuration. While this does nothing under the Xerces 3.1 in Xenial, it provides generic impersonation protection for Xerces 3.2. This patch is a pre-req to get the upstream CVE-2018-0489 patch to apply cleanly.

- Upstream's patch for CVE-2018-0489.