Matt "msw" Wilson

@msw.bsky.social

785 Followers 298 Following

“For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled.”

The Vulnerability The libxml2 issue (GitLab work item #1097) is a type confusion in xmlParseReference() that occurs exclusively when streaming XSD schema validation is active. The bug passes ctxt (parser context) instead of ctxt->userData to SAX characters() / cdataBlock() callbacks. This only causes a crash when xmlSchemaSAXPlug has redirected those callbacks — meaning schema validation must be enabled on the reader/parser. How libarchive uses libxml2 libarchive uses libxml2 solely for parsing XAR archive table-of-contents XML in archive_read_support_format_xar.c. It uses the xmlTextReader pull-parsing API: - xmlTextReaderRead() - xmlTextReaderNodeType() - xmlTextReaderConstLocalName() - xmlTextReaderConstValue() - xmlTextReaderMoveToFirstAttribute() / MoveToNextAttribute() It does not call any schema validation functions: - No xmlTextReaderSchemaValidate() - No xmlSchemaSAXPlug() - No xmlSchemaValidateStream() - No xmlSchemaNewValidCtxt() Conclusion Not affected. The vulnerable code path requires XSD streaming validation to be plugged into the SAX layer. libarchive never enables schema validation — it just reads XML nodes from XAR TOC data. Without the schema validation SAX plug active, the type confusion in xmlParseReference() cannot be triggered, even if the XML being parsed contains entity references.
Screenshot showing Inbox, Saved, and Done labels from Github. There's a 1 in a circle
The sun rises at the horizon, reflecting of the water of Eagle Harbor. The car deck of the Washington State ferry Tacoma is in the foreground.
A sanded walnut table sits in a garage, light brown in color and ashy in spots
The following Linux HOWTOs are currently available: 3-Button-Mouse, The 3 Button Serial Mouse mini-HOWTO Updated: May 1998. How to get a 3 button serial mouse working properly under Linux. 3D-Modelling, 3D Graphics Modelling and Rendering mini-HOWTO Updated: Mar 2001. Details download and installation instructions for a graphics rendering and modelling development environment using RedHat Linux. 4mb-Laptops, 4mb Laptop HOWTO Updated: Apr 2000. Put a "grown-up" Linux on a small-spec (4mb RAM, <=200mb hard disk) laptop.