--- libxerces2-java-2.9.1.orig/debian/libxerces2-java.links +++ libxerces2-java-2.9.1/debian/libxerces2-java.links @@ -0,0 +1,2 @@ +/usr/share/java/jaxp-1.3.jar /usr/share/java/xmlParserAPIs.jar +/usr/share/java/jaxp-1.3.jar /usr/share/maven-repo/xerces/xmlParserAPIs/2.6.2/xmlParserAPIs-2.6.2.jar --- libxerces2-java-2.9.1.orig/debian/libxerces2-java-doc.examples +++ libxerces2-java-2.9.1/debian/libxerces2-java-doc.examples @@ -0,0 +1,3 @@ +build/samples/* +build/xercesSamples.jar + --- libxerces2-java-2.9.1.orig/debian/pom.xml +++ libxerces2-java-2.9.1/debian/pom.xml @@ -0,0 +1,44 @@ + + + + 4.0.0 + + org.apache + apache + 4 + + xerces + xercesImpl + 2.9.1 + Xerces2 Java Parser + + Xerces2 is the next generation of high performance, fully compliant XML parsers in the + Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), + a complete framework for building parser components and configurations that is extremely + modular and easy to program. + + http://xerces.apache.org/xerces2-j + + + + xml-apis + xml-apis + 1.3.04 + + + xml-resolver + xml-resolver + 1.2 + true + + + + + + src + + + \ No newline at end of file --- libxerces2-java-2.9.1.orig/debian/ant.properties +++ libxerces2-java-2.9.1/debian/ant.properties @@ -0,0 +1,4 @@ +jar.apis=jaxp-1.3.jar +jar.resolver=xml-commons-resolver-1.1.jar +tools.dir=/usr/share/java + --- libxerces2-java-2.9.1.orig/debian/libxerces2-java.docs +++ libxerces2-java-2.9.1/debian/libxerces2-java.docs @@ -0,0 +1,6 @@ +NOTICE +NOTICE.resolver.txt +NOTICE.serializer.txt +README +Readme.html + --- libxerces2-java-2.9.1.orig/debian/changelog +++ libxerces2-java-2.9.1/debian/changelog @@ -0,0 +1,247 @@ +libxerces2-java (2.9.1-4.1) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Fixed CVE-2009-2625: denial of service (infinite loop and application hang) + via malformed XML input (Closes: #548358) + + -- Giuseppe Iuculano Fri, 29 Jan 2010 11:19:09 +0100 + +libxerces2-java (2.9.1-4) unstable; urgency=low + + * Upload to unstable. + + -- Torsten Werner Sun, 09 Aug 2009 12:48:51 +0200 + +libxerces2-java (2.9.1-3) experimental; urgency=low + + * Change section to java, bump up Standards-Version to 3.8.1 + * Bump up debhelper to 6 + * Add the Maven POM to the package, + * Add a Build-Depends dependency on maven-repo-helper + * Use mh_installpom and mh_installjar to install the POM and the jar to the + Maven repository + * Add ${misc:Depends} to Depends to clear Lintian warnings + * Remove full text of the Apache 2 license from copyright + + [Matthias Klose] + * Set java source and target version to 1.4. LP: #264808. + * Depend on default-jre-headless. + + -- Ludovic Claude Thu, 07 May 2009 20:44:34 +0100 + +libxerces2-java (2.9.1-2) unstable; urgency=low + + * Build-Depends on default-jdk-builddep. Closes: #477892 + + -- Michael Koch Sun, 27 Apr 2008 06:37:01 -0100 + +libxerces2-java (2.9.1-1) unstable; urgency=low + + * New upstream version. + * Updated Standards-Version to 3.7.3. + * Added myself to Uploaders. + * Added Vcs-Svn and Vcs-Browser fields. + + -- Michael Koch Mon, 31 Dec 2007 11:02:34 +0100 + +libxerces2-java (2.9.0-1) unstable; urgency=low + + * New upstream. + * debian/control: removed Stefan Gybas and Wolfgang Baer from uploaders. + * debian/rule: added generation of the documentation (merge + libxerces2-java-doc). + + -- Arnaud Vandyck Tue, 3 Jul 2007 20:21:12 +0200 + +libxerces2-java (2.8.1-2) unstable; urgency=low + + [Arnaud Vandyck] + * debian/watch: added + + [Matthias Klose] + * Merge from Ubuntu: + - Build architecture dependent -gcj package. + - Move build-indep dependencies to build dependencies. + - Add gij as alternative runtime dependency. + + -- Matthias Klose Wed, 3 Jan 2007 13:27:26 +0100 + +libxerces2-java (2.8.1-1) unstable; urgency=low + + * New upstream version. + * Add dependency on libjaxp1.3-java. (Closes: #394221) + * Correct copyright information. + + -- Marcus Better Sun, 22 Oct 2006 21:39:07 +0200 + +libxerces2-java (2.8.0-1) unstable; urgency=low + + * upload to unstable. + + -- Arnaud Vandyck Mon, 3 Jul 2006 11:29:15 +0000 + +libxerces2-java (2.8.0-0) experimental; urgency=low + + * New upstream release. + * Built with gcj + * Updated to Standards-Version 3.7.2: cdbs and debhelper to + Build-Depends + * Removed jikes compiler definition + + -- Arnaud Vandyck Mon, 3 Jul 2006 13:27:27 +0200 + +libxerces2-java (2.6.2-4) unstable; urgency=low + + * gnujaxp transition + + -- Wolfgang Baer Tue, 17 Jan 2006 21:50:14 +0100 + +libxerces2-java (2.6.2-3) unstable; urgency=low + + * libant1.6-java to ant transition + * As we now have ant >= 1.6.3 we can drop the dom2 source hack + + Remove dom2 source from debian package + + Added bootclasspath patch to the javac target + * Standards-Version 3.6.2 (no changes) + + -- Wolfgang Baer Sun, 25 Sep 2005 02:02:36 +0200 + +libxerces2-java (2.6.2-2) unstable; urgency=medium + + * Included DOM Level 2 sources from the libjaxp1.2-java + source package to built against them (closes: #304524) + Note: This is a temporary solution - after sarge we will update + ant which includes bootclasspath support for jikes need to build + without included sources. + * Included README.dom2-sources explaining where the DOM Level 2 sources + come from, why they are needed ... + * Included build.xml patch to copy the DOM Level 2 sources from the + debian directory - before the build - to the build directory. + * Changed Build-Depends to Build-Depends-Indep to fix lintian warning. + * (avdyk) Added Wolfgang to the uploaders. + + -- Wolfgang Baer Tue, 19 Apr 2005 20:28:25 +0200 + +libxerces2-java (2.6.2-1) unstable; urgency=low + + * New upstream release + * Build with free-java-sdk / SableVM instead of Kaffe so I don't need the + ugly LD_LIBRARY_PATH hack any longer (closes: #246468) + * Use libgnujaxp-java instead of libxerces-java to call Ant since it's + included by the SableVM wrapper automatically. It's a bit strange to use + an external XML parser to build an XML parser but such is life... + * Change the classpath dependency to classpath-common + + -- Stefan Gybas Sun, 6 Jun 2004 18:00:26 +0200 + +libxerces2-java (2.6.1-1) unstable; urgency=low + + * New upstream release + * Split the libxerces2-java source package into libxerces2-java (main) + and libxerces2-java-doc (contrib). The package in main now builds the + library package, the one in contrib the documentation. Building the + documentation requires JDK 1.4 and other packages from contrib. The split + also avoids circular build dependencies with Xalan-J. + * Use Kaffe, Jikes and Ant 1.6 to build the package + * Use the new libjaxp1.2-java and libxml-commons-resolver1.1-java packages + * Updated the package description and README.Debian + + -- Stefan Gybas Wed, 18 Feb 2004 14:17:24 +0100 + +libxerces2-java (2.6.0-1) unstable; urgency=low + + * New upstream release + * Depend on "classpath | java1-runtime | java2-runtime" + * Updated download location and copyright years in debian/copyright + * Move xercesSamples.jar from libxerces2-java to the examples in + libxerces2-java-doc + * Don't install versioned JARs in /usr/share/java. Sorry, I'm unable to + determine an API version. This version is fully compatible to version + 2.5.*, 2.4.* and others. Should I create 5 symlinks for each JAR to + prevent other packages that use the versioned JAR from breaking? + + -- Stefan Gybas Tue, 13 Jan 2004 22:15:43 +0100 + +libxerces2-java (2.5.0-1) unstable; urgency=low + + * New upstream release (closes: #206185) + * Renamed to source package to libxerces2-java + * Set maintainer to Debian Java Maintainers + * Mention XML Inclusions (XInclude) in the long description + * Standards-Version: 3.6.1 + + Changed Build-Depends-Indep to Build-Depends + + -- Stefan Gybas Fri, 17 Oct 2003 15:22:07 +0200 + +xerces2-j (2.4.0-1) unstable; urgency=low + + * New upstream release + * Built using Blackdown's JDK 1.4 instead of the converted RPM from Sun + * Standards-Version: 3.5.9 (no changes required) + + -- Stefan Gybas Sun, 13 Apr 2003 18:50:54 +0200 + +xerces2-j (2.3.0-1) unstable; urgency=low + + * New upstream release + + Fixes the DTD parsing problems in Tomcat 4 (closes: #167135, #171929) + * Build with the latest Jikes version (>= 1.18) + * Include the compiled examples (xercesSamples.jar) (closes: #170822) + * Enable experimental DOM Level 3 support and updated the package + description about the new XML 1.1 features + + -- Stefan Gybas Mon, 10 Feb 2003 19:54:06 +0100 + +xerces2-j (2.2.1-1) unstable; urgency=low + + * New upstream release + * Added versioned build dependency on jikes + * Compile the classes with debugging enabled + * Standards-Version: 3.5.8 (no changes required) + + -- Stefan Gybas Mon, 18 Nov 2002 15:10:27 +0100 + +xerces2-j (2.2.0-1) unstable; urgency=low + + * New upstream release + * Added Takashi Okamoto and Ola Lundqvist as uploaders + * Use jikes to compile the Java classes + + -- Stefan Gybas Wed, 23 Oct 2002 18:23:15 +0200 + +xerces2-j (2.1.0-1) unstable; urgency=low + + * New upstream release + * Updated package description + * Build with latest Ant and Xalan-J versions + * Fixed some typos in README.Debian + * Build with debhelper >= 4.1.0 to get rid of /usr/doc compatibility + symlinks + * Standards-Version: 3.5.7 + + -- Stefan Gybas Mon, 2 Sep 2002 15:35:13 +0200 + +xerces2-j (2.0.2-1) unstable; urgency=low + + * New upstream release + * Build with j2sdk >= 1.4.0 because it supports -Djava.awt.headless=true + for Xalan and so an X11 display is not needed during the build + * Use debhelper V4 + * Updated README.Debian and package description + + -- Stefan Gybas Mon, 1 Jul 2002 20:44:04 +0200 + +xerces2-j (2.0.1-1) unstable; urgency=low + + * New upstream release (closes: #140832) + * The package can now be built with j2sdk1.3 1.3.1-1 or later + + -- Stefan Gybas Wed, 3 Apr 2002 21:05:23 +0200 + +xerces2-j (2.0.0-1) unstable; urgency=low + + * Initial release + * Placed in contrib because it requires Ant and a Java2 environment + to build + + -- Stefan Gybas Thu, 7 Feb 2002 16:37:15 +0100 --- libxerces2-java-2.9.1.orig/debian/README.Debian +++ libxerces2-java-2.9.1/debian/README.Debian @@ -0,0 +1,11 @@ +Xerces2-J for Debian +==================== + +- Unlike Xerces-J 1.x (Debian package libxerces-java) this package contains + two JARs in /usr/share/java/ which both need to be in your class path: + * xercesImpl.jar contains the actual Xerces parser + * xmlParserAPIs.jar contains the XML APIs (DOM, SAX) which are used by + all standard XML parsers. This is a symbolic link to jaxp-1.3.jar from + the libjaxp1.3-java package. + + -- Marcus Better , Sun, 22 Oct 2006 21:42:14 +0200 --- libxerces2-java-2.9.1.orig/debian/control +++ libxerces2-java-2.9.1/debian/control @@ -0,0 +1,61 @@ +Source: libxerces2-java +Section: java +Priority: optional +Maintainer: Debian Java Maintainers +Uploaders: Arnaud Vandyck , Marcus Better , Matthias Klose , Michael Koch +Build-Depends: cdbs (>= 0.4.8), debhelper (>= 6), default-jdk-builddep, ant, + maven-repo-helper, libxml-commons-resolver1.1-java, libjaxp1.3-java, libstylebook-java +Standards-Version: 3.8.1 +Vcs-Svn: svn://svn.debian.org/svn/pkg-java/trunk/libxerces2-java +Vcs-Browser: http://svn.debian.org/wsvn/pkg-java/trunk/libxerces2-java +Homepage: http://xerces.apache.org/xerces2-j/ + +Package: libxerces2-java +Architecture: all +Depends: ${misc:Depends}, default-jre-headless | java1-runtime-headless | java2-runtime-headless, libjaxp1.3-java +Recommends: libxerces2-java-gcj +Suggests: libxerces2-java-doc +Description: Validating XML parser for Java with DOM level 3 support + The Xerces2 Java parser is the reference implementation of XNI, the + Xerces Native Interface, and also a fully conforming XML Schema processor. + . + Xerces2-J supports the following standards and APIs: + * eXtensible Markup Language (XML) 1.0 Second Edition Recommendation + * Namespaces in XML Recommendation + * Document Object Model (DOM) Level 2 Core, Events, and Traversal and + Range Recommendations + * Simple API for XML (SAX) 2.0.1 Core and Extension + * Java APIs for XML Processing (JAXP) 1.2.01 + * XML Schema 1.0 Structures and Datatypes Recommendations + * Experimental implementation of the Document Object Model (DOM) Level 3 + Core and Load/Save Working Drafts + * Provides a partial implementation of the XML Inclusions (XInclude) W3C + Candidate Recommendation + . + Xerces is now able to parse documents written according to the XML 1.1 + Candidate Recommendation, except that it does not yet provide an option to + enable normalization checking as described in section 2.13 of this + specification. It also handles namespaces according to the XML Namespaces 1.1 + Candidate Recommendation, and will correctly serialize XML 1.1 documents if + the DOM level 3 load/save API's are in use. + +Package: libxerces2-java-gcj +Architecture: any +Depends: libxerces2-java (>= ${source:Version}), libjaxp1.3-java-gcj, ${misc:Depends}, ${shlibs:Depends} +Description: Validating XML parser for Java with DOM level 3 support (native code) + The Xerces2 Java parser is the reference implementation of XNI, the + Xerces Native Interface, and also a fully conforming XML Schema processor. + . + This package contains the natively compiled code for use by gij. + +Package: libxerces2-java-doc +Architecture: all +Section: doc +Depends: ${misc:Depends} +Suggests: libxerces2-java, doc-html-w3 +Description: Validating XML parser for Java -- Documentation and examples + The Xerces2 Java parser is the reference implementation of XNI, the + Xerces Native Interface, and also a fully conforming XML Schema processor. + . + This package contains the documentation in HTML format, the Javadoc API + documentation and some examples. --- libxerces2-java-2.9.1.orig/debian/copyright +++ libxerces2-java-2.9.1/debian/copyright @@ -0,0 +1,71 @@ +This package was debianized by Stefan Gybas on 07-Feb-2002. + +The source was downloaded from . + +It is currently maintained by the Debian Java Maintainers +. + +Copyright (C) 1999-2006 The Apache Software Foundation. +Copyright (C) 2000-2001 World Wide Web Consortium. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +The full text of the license can be found in +'/usr/share/common-licenses/Apache-2.0'. + +Parts of Xerces2 are covered by the following license: + + W3C® SOFTWARE NOTICE AND LICENSE + http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231 + + This work (and included software, documentation such as READMEs, or + other related items) is being provided by the copyright holders under + the following license. By obtaining, using and/or copying this work, + you (the licensee) agree that you have read, understood, and will + comply with the following terms and conditions. + + Permission to copy, modify, and distribute this software and its + documentation, with or without modification, for any purpose and + without fee or royalty is hereby granted, provided that you include + the following on ALL copies of the software and documentation or + portions thereof, including modifications: + + 1. The full text of this NOTICE in a location viewable to users of + the redistributed or derivative work. + + 2. Any pre-existing intellectual property disclaimers, notices, or + terms and conditions. If none exist, the W3C Software Short + Notice should be included (hypertext is preferred, text is + permitted) within the body of any redistributed or derivative + code. + + 3. Notice of any changes or modifications to the files, including + the date changes were made. (We recommend you provide URIs to the + location from which the code is derived.) + + THIS SOFTWARE AND DOCUMENTATION IS PROVIDED "AS IS," AND COPYRIGHT + HOLDERS MAKE NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, + INCLUDING BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY OR FITNESS + FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE SOFTWARE OR + DOCUMENTATION WILL NOT INFRINGE ANY THIRD PARTY PATENTS, COPYRIGHTS, + TRADEMARKS OR OTHER RIGHTS. + + COPYRIGHT HOLDERS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL + OR CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THE SOFTWARE OR + DOCUMENTATION. + + The name and trademarks of copyright holders may NOT be used in + advertising or publicity pertaining to the software without specific, + written prior permission. Title to copyright in this software and any + associated documentation will at all times remain with copyright + holders. --- libxerces2-java-2.9.1.orig/debian/rules +++ libxerces2-java-2.9.1/debian/rules @@ -0,0 +1,54 @@ +#!/usr/bin/make -f +# debian/rules file for libxerces2-java (uses cdbs) + +# Uncomment this to turn on verbose mode. +export DH_VERBOSE=1 + +include /usr/share/cdbs/1/rules/debhelper.mk +include /usr/share/cdbs/1/rules/simple-patchsys.mk +include /usr/share/cdbs/1/class/ant.mk + +PACKAGE := $(DEB_SOURCE_PACKAGE) +VERSION := $(DEB_UPSTREAM_VERSION) +JAVA_HOME := /usr/lib/jvm/default-java +ANT_HOME := /usr/share/ant +ANT_OPTS = -Dant.build.javac.source=1.4 -Dant.build.javac.target=1.4 + +include /usr/share/gcj/debian_defaults +ifneq (,$(filter $(DEB_HOST_ARCH), $(gcj_native_archs))) + with_gcj_native := yes +endif + +# Additional JARs to add to the class path, either full path or just the +# basename for JARs in /usr/share/java. The ".jar" suffix may also be ommitted +DEB_JARS := xml-commons-resolver-1.1 +#jaxp-1.3.jar stylebook + +# Ant targets to call +DEB_ANT_CLEAN_TARGET := clean +DEB_ANT_BUILD_TARGET := jar sampjar javadocs +#docs + +install/$(PACKAGE):: + mh_installpoms -p$(PACKAGE); + mh_installjar -p$(PACKAGE) -l debian/pom.xml $(DEB_BUILDDIR)/build/xercesImpl.jar + +ifeq ($(with_gcj_native),yes) +install/libxerces2-java-gcj:: install/libxerces2-java + dh_nativejava -plibxerces2-java-gcj +endif + +clean:: + rm -rf build + -rm -rf debian/tmp + +binary-post-install/libxerces2-java-doc:: + dh_install -plibxerces2-java-doc build/docs/javadocs/* \ + usr/share/doc/libxerces2-java-doc/api + +get-orig-source: + -uscan --download-version $(DEB_UPSTREAM_VERSION) --force-download --rename --repack + +get-orig-pom: + wget -O debian/pom.xml http://repository.sonatype.org/service/local/repositories/central/content/xerces/xercesImpl/$(VERSION)/xercesImpl-$(VERSION).pom + --- libxerces2-java-2.9.1.orig/debian/watch +++ libxerces2-java-2.9.1/debian/watch @@ -0,0 +1,2 @@ +version=3 +http://www.apache.org/dist/xml/xerces-j/source/ Xerces-J-src\.([\d+\.]+|\d+)\.tar\.gz debian uupdate --- libxerces2-java-2.9.1.orig/debian/compat +++ libxerces2-java-2.9.1/debian/compat @@ -0,0 +1 @@ +6 --- libxerces2-java-2.9.1.orig/debian/libxerces2-java.poms +++ libxerces2-java-2.9.1/debian/libxerces2-java.poms @@ -0,0 +1,2 @@ +debian/pom.xml --no-parent + --- libxerces2-java-2.9.1.orig/debian/patches/03_bootclasspath.patch +++ libxerces2-java-2.9.1/debian/patches/03_bootclasspath.patch @@ -0,0 +1,12 @@ +--- build.xml.orig 2005-09-25 02:22:43.000000000 +0200 ++++ build.xml 2005-09-25 02:18:57.000000000 +0200 +@@ -228,7 +228,8 @@ + deprecation="${deprecation}" + optimize="${optimize}" + includeAntRuntime="false" +- includeJavaRuntime="false" ++ includeJavaRuntime="true" ++ bootclasspath="/usr/share/java/jaxp-1.3.jar" + excludes="org/xml/sax/** + javax/xml/parsers/** + org/w3c/dom/* --- libxerces2-java-2.9.1.orig/debian/patches/01_xjavac_taskdef.patch +++ libxerces2-java-2.9.1/debian/patches/01_xjavac_taskdef.patch @@ -0,0 +1,11 @@ +--- build.xml~ 2006-03-01 01:14:50.000000000 +0000 ++++ build.xml 2006-07-03 09:58:48.000000000 +0000 +@@ -28,7 +28,7 @@ + + + +- ++ + + + --- libxerces2-java-2.9.1.orig/debian/patches/04_CVE-2009-2625.patch +++ libxerces2-java-2.9.1/debian/patches/04_CVE-2009-2625.patch @@ -0,0 +1,20 @@ +CVE-2009-2625 +diff --git a/src/org/apache/xerces/impl/XMLScanner.java b/src/org/apache/xerces/impl/XMLScanner.java +index a64ce11..1abca0e 100644 +--- a/src/org/apache/xerces/impl/XMLScanner.java ++++ b/src/org/apache/xerces/impl/XMLScanner.java +@@ -1027,6 +1027,14 @@ public abstract class XMLScanner + if (XMLChar.isMarkup(c) || c == ']') { + fStringBuffer.append((char)fEntityScanner.scanChar()); + } ++ else if (XMLChar.isHighSurrogate(c)) { ++ scanSurrogates(fStringBuffer); ++ } ++ else if (isInvalidLiteral(c)) { ++ reportFatalError("InvalidCharInSystemID", ++ new Object[] { Integer.toHexString(c) }); ++ fEntityScanner.scanChar(); ++ } + } while (fEntityScanner.scanLiteral(quote, ident) != quote); + fStringBuffer.append(ident); + ident = fStringBuffer; --- libxerces2-java-2.9.1.orig/debian/patches/02_build_dont_unzip.patch +++ libxerces2-java-2.9.1/debian/patches/02_build_dont_unzip.patch @@ -0,0 +1,18 @@ +--- build.xml.orig 2004-01-30 16:42:54.000000000 +0100 ++++ build.xml 2004-02-18 13:40:34.000000000 +0100 +@@ -191,6 +191,7 @@ + + + ++ + + +