Apply upstream patch to close XXE vulnerability in precise

I've requested a CVE for this issue, thanks.

This bug was fixed in the package libxml2 - 2.7.8.dfsg-5.1ubuntu4.5

---------------
libxml2 (2.7.8.dfsg-5.1ubuntu4.5) precise-security; urgency=low

  * SECURITY UPDATE: external entity expansion attack (LP: #1194410)
    - do not fetch external parsed entities in parser.c, added test to
      test/errors/extparsedent.xml, result/errors/extparsedent.xml.
    - https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f
    - CVE-2013-0339
  * SECURITY UPDATE: denial of service via incomplete document
    - try to stop parsing as quickly as possible in parser.c,
      include/libxml/xmlerror.h.
    - https://git.gnome.org/browse/libxml2/commit/?id=48b4cdde3483e054af8ea02e0cd7ee467b0e9a50
    - https://git.gnome.org/browse/libxml2/commit/?id=e50ba8164eee06461c73cd8abb9b46aa0be81869
    - CVE-2013-2877
 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2013 14:57:48 -0400

This bug was fixed in the package libxml2 - 2.7.6.dfsg-1ubuntu1.9

---------------
libxml2 (2.7.6.dfsg-1ubuntu1.9) lucid-security; urgency=low

  * SECURITY UPDATE: external entity expansion attack (LP: #1194410)
    - do not fetch external parsed entities in parser.c, added test to
      test/errors/extparsedent.xml, result/errors/extparsedent.xml.
    - https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f
    - CVE-2013-0339
  * SECURITY UPDATE: denial of service via incomplete document
    - try to stop parsing as quickly as possible in parser.c,
      include/libxml/xmlerror.h.
    - https://git.gnome.org/browse/libxml2/commit/?id=48b4cdde3483e054af8ea02e0cd7ee467b0e9a50
    - https://git.gnome.org/browse/libxml2/commit/?id=e50ba8164eee06461c73cd8abb9b46aa0be81869
    - CVE-2013-2877
 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2013 15:07:11 -0400

This bug was fixed in the package libxml2 - 2.8.0+dfsg1-5ubuntu2.3

---------------
libxml2 (2.8.0+dfsg1-5ubuntu2.3) quantal-security; urgency=low

  * SECURITY UPDATE: external entity expansion attack (LP: #1194410)
    - debian/patches/CVE-2013-0339.patch: do not fetch external parsed
      entities in parser.c, added test to test/errors/extparsedent.xml,
      result/errors/extparsedent.xml.
    - CVE-2013-0339
  * SECURITY UPDATE: denial of service via incomplete document
    - debian/patches/CVE-2013-2877.patch: try to stop parsing as quickly as
      possible in parser.c, include/libxml/xmlerror.h.
    - CVE-2013-2877
 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2013 14:53:41 -0400

I saw something like a regression in some case, or maybe I'm misusing the library:

>>> from io import BytesIO
>>> from lxml import etree
>>> xml='''<root>
... <child name='one' />
... <child name='two' />
... </root>
... '''
>>> document = etree.iterparse(BytesIO(xml), events=('end',), tag='root')
>>> for action, elem in document:
... print("%s: %s" % (action, elem.tag))
...
end: root
>>> file('/tmp/test.xml', 'w').write(xml)
>>> document = etree.iterparse('/tmp/test.xml', events=('end',), tag='root')
>>> for action, elem in document:
... print("%s: %s" % (action, elem.tag))
...
end: root
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "iterparse.pxi", line 478, in lxml.etree.iterparse.__next__ (src/lxml/lxml.etree.c:98432)
  File "iterparse.pxi", line 530, in lxml.etree.iterparse._read_more_events (src/lxml/lxml.etree.c:98953)
  File "parser.pxi", line 601, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:74863)
lxml.etree.XMLSyntaxError: None

Downgrading libxml2 version 2.7.8.dfsg-5.1ubuntu4 does not finish in a traceback when parsing from a file.

Thanks for reporting this regression. I've opened bug 1201849 to track it.

Hi, not sure if I even need this libxml2 as I don't write code or publish websites, as I think this may be what it's for?
I do however have this error and totally do not know what to do with the file I just downloaded.
I'm just a happy Ubuntu user :)
Any help would be gratefully acccepted!!

Thanks

Andrew