iiinova — where your digital self keeps evolving

Matt "msw" Wilson

@msw.bsky.social

792 followers 300 following 210 posts

“For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled.”

Matt "msw" Wilson @msw.bsky.social · 19/05/2026

Y'all, AI models seem to be *really good* at triaging vulnerabilities that are discovered with AI tooling! Try this prompt: > read gitlab.gnome.org/GNOME/libxml... and tell me if CVE-2026-6732 applies to github.com/libarchive/l... [...] Conclusion Not affected.

The Vulnerability

The libxml2 issue (GitLab work item #1097) is a type confusion in xmlParseReference() that occurs exclusively when streaming XSD schema validation is active. The bug passes ctxt (parser context) instead of ctxt->userData to SAX characters() / cdataBlock() callbacks. This only causes a crash when xmlSchemaSAXPlug has redirected those callbacks — meaning schema validation must be enabled on the reader/parser.

How libarchive uses libxml2

libarchive uses libxml2 solely for parsing XAR archive table-of-contents XML in archive_read_support_format_xar.c. It uses the xmlTextReader pull-parsing API:
- xmlTextReaderRead()
- xmlTextReaderNodeType()
- xmlTextReaderConstLocalName()
- xmlTextReaderConstValue()
- xmlTextReaderMoveToFirstAttribute() / MoveToNextAttribute()

It does not call any schema validation functions:
- No xmlTextReaderSchemaValidate()
- No xmlSchemaSAXPlug()
- No xmlSchemaValidateStream()
- No xmlSchemaNewValidCtxt()

Conclusion

Not affected. The vulnerable code path requires XSD streaming validation to be plugged into the SAX layer. libarchive
never enables schema validation — it just reads XML nodes from XAR TOC data. Without the schema validation SAX plug
active, the type confusion in xmlParseReference() cannot be triggered, even if the XML being parsed contains entity
references.

110

Matt "msw" Wilson @msw.bsky.social · 25/03/2026

Fun fact: when you have more than 1,000 notices on GitHub, it says you have 1. It should be like tabs in Chrome on mobile devices, where past 100 it shows ":)"

Screenshot showing Inbox, Saved, and Done labels from Github. There's a 1 in a circle

150

Matt "msw" Wilson @msw.bsky.social · 31/10/2025

#FerryLife #WAWX #Seattle #Sunrise

The sun rises at the horizon, reflecting of the water of Eagle Harbor. The car deck of the Washington State ferry Tacoma is in the foreground.

0122

Matt "msw" Wilson @msw.bsky.social · 24/01/2025

How it started How it’s going

A sanded walnut table sits in a garage, light brown in color and ashy in spots

The same table after a liberal coat of Osmo 4006 wood protector. It is now a deep brown with highlighted grain and figure. It is shiny, but that will fade as it drys.

2110

Matt "msw" Wilson @msw.bsky.social · 05/05/2023

Who remembers the age of the HOWTO, where one could get subject-specific help on how to use their CD burner, how to set up WvDial for their dial-up PPP connection to surf the Internet, or other topical subjects of the era? What was your favorite? tldp.org/HOWTO/HOWTO-INDEX/howtos.h…

The following Linux HOWTOs are currently available:

3-Button-Mouse, The 3 Button Serial Mouse mini-HOWTO

Updated: May 1998. How to get a 3 button serial mouse working properly under Linux.

3D-Modelling, 3D Graphics Modelling and Rendering mini-HOWTO

Updated: Mar 2001. Details download and installation instructions for a graphics rendering and modelling development environment using RedHat Linux.

4mb-Laptops, 4mb Laptop HOWTO

Updated: Apr 2000. Put a "grown-up" Linux on a small-spec (4mb RAM, <=200mb hard disk) laptop.

130