This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "armadeus".
The branch, master has been updated
via 163911cf6596c93efaee62ce590e8525e4f9ec9c (commit)
via ad838ed48ddc6e13a7a353c6de7717d526ca563d (commit)
from 0c9112946493d31ca22ca93c2f73fe3205dc6450 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 163911cf6596c93efaee62ce590e8525e4f9ec9c
Author: Sébastien Szymanski <seb...@ar...>
Date: Tue Sep 3 11:18:52 2019 +0200
BUILDROOT] 2019.02: unzip: fix downloading by updating patches from Debian
commit ad838ed48ddc6e13a7a353c6de7717d526ca563d
Author: Sébastien Szymanski <seb...@ar...>
Date: Tue Sep 3 11:12:15 2019 +0200
[BSP] bump to BR 2019.02.5
-----------------------------------------------------------------------
Summary of changes:
Makefile | 2 +-
...ip-update-security-and-bux-fix-patches-fr.patch | 116 ++++++++++-----------
2 files changed, 56 insertions(+), 62 deletions(-)
diff --git a/Makefile b/Makefile
index e871b1529..32613febe 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ export ARMADEUS_TOPDIR
#--- User configurable stuff:
BUILDROOT_MAJOR_VERSION ?= 2019.02
-BUILDROOT_VERSION ?= $(BUILDROOT_MAJOR_VERSION).4
+BUILDROOT_VERSION ?= $(BUILDROOT_MAJOR_VERSION).5
include ./Makefile.in
BUILDROOT_SITE:=https://buildroot.org/downloads
BUILDROOT_PATCH_DIR:=$(ARMADEUS_TOPDIR)/patches/buildroot/$(BUILDROOT_MAJOR_VERSION)
diff --git a/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch b/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
index bd3fe9ff3..79fcb70fe 100644
--- a/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
+++ b/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
@@ -1,87 +1,81 @@
-From 1df827a1219a61cba3ace88a3ef5d2cc02d17b32 Mon Sep 17 00:00:00 2001
+From eda353497d512b1a036caedfdc574b1643cb43e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?=
<seb...@ar...>
-Date: Fri, 12 Jul 2019 15:15:26 +0200
-Subject: [PATCH 1/1] package/unzip: update security and bux fix patches from
- Debian
+Date: Tue, 3 Sep 2019 10:26:19 +0200
+Subject: [PATCH 1/1] package/unzip: add security patch from Debian
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
-Fix the URL and add three new patches. Quoting changelog [1]:
+Fix the URL and add a new patch. Quoting changelog [1]:
-unzip (6.0-24) unstable; urgency=medium
+unzip (6.0-25) unstable; urgency=medium
- * Apply two patches by Mark Adler:
- - Fix bug in undefer_input() that misplaced the input state.
- - Detect and reject a zip bomb using overlapped entries. Closes: #931433.
- Bug discovered by David Fifield. For reference, this is CVE-2019-13232.
+ * Apply one more patch by Mark Adler:
+ - Do not raise a zip bomb alert for a misplaced central directory.
+ This should allow Firefox to build again. Closes: #932404.
+ Reported by Peter Green. Hopefully CVE-2019-13232 is fixed now.
- -- Santiago Vila <sa...@de...> Thu, 11 Jul 2019 18:03:34 +0200
+ -- Santiago Vila <sa...@de...> Sat, 27 Jul 2019 18:01:36 +0200
-unzip (6.0-23) unstable; urgency=medium
-
- * Fix lame code in fileio.c which parsed 64-bit values incorrectly.
- Thanks to David Fifield for the report. Closes: #929502.
-
- -- Santiago Vila <sa...@de...> Wed, 29 May 2019 00:24:08 +0200
-
-[1] https://sources.debian.org/data/main/u/unzip/6.0-24/debian/changelog
+[1] https://sources.debian.org/data/main/u/unzip/6.0-25/debian/changelog
Signed-off-by: Sébastien Szymanski <seb...@ar...>
---
- package/unzip/unzip.hash | 3 +++
- package/unzip/unzip.mk | 29 ++++++++++++++++-------------
- 2 files changed, 19 insertions(+), 13 deletions(-)
+ package/unzip/unzip.hash | 1 +
+ package/unzip/unzip.mk | 33 +++++++++++++++++----------------
+ 2 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/package/unzip/unzip.hash b/package/unzip/unzip.hash
-index fbf2615ad6..0c384d006e 100644
+index 0c384d006e..a10778a468 100644
--- a/package/unzip/unzip.hash
+++ b/package/unzip/unzip.hash
-@@ -13,3 +13,6 @@ sha256 ea04cfc8b7ca3b3c03117da0d891870b8c542d26188ef5593fd7e479f4f29f4e 17-resto
- sha256 1872ffdd4d82edd7b1e62c469642bf16a1ca12dd26d41bd3f0b44f0f7602eb63 18-cve-2014-9913-unzip-buffer-overflow.patch
- sha256 60840ea8f5d11a276972fb5b43652cdd49a9ed93b2cc0586ad309bf52104b012 19-cve-2016-9844-zipinfo-buffer-overflow.patch
- sha256 4eabc3faeddd56ebc3d5053486b61f8758d840902725fd555d3472cffb094437 20-cve-2018-1000035-unzip-buffer-overflow.patch
-+sha256 df3b0eeea8dcc161a2565e306b5dda13d27de43145e198baaf0eab822321ee7e 21-fix-warning-messages-on-big-files.patch
-+sha256 2cf5a89e921da99e883bcde0ea03e2c77ae9185f57efaf35e7d43bc24353cfdc 22-cve-2019-13232-fix-bug-in-undefer-input.patch
-+sha256 c8e82c80fc7760f90567118a465e4cfa1b8e5d0a5723f9c70e3d21247e550615 23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
+@@ -16,3 +16,4 @@ sha256 4eabc3faeddd56ebc3d5053486b61f8758d840902725fd555d3472cffb094437 20-cve-2
+ sha256 df3b0eeea8dcc161a2565e306b5dda13d27de43145e198baaf0eab822321ee7e 21-fix-warning-messages-on-big-files.patch
+ sha256 2cf5a89e921da99e883bcde0ea03e2c77ae9185f57efaf35e7d43bc24353cfdc 22-cve-2019-13232-fix-bug-in-undefer-input.patch
+ sha256 c8e82c80fc7760f90567118a465e4cfa1b8e5d0a5723f9c70e3d21247e550615 23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
++sha256 37ba0bea723beeb22670babda18bd980368cc6591bc7bd9caa04f62692c7e5ac 24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch
diff --git a/package/unzip/unzip.mk b/package/unzip/unzip.mk
-index 43e90125e6..2887b7b288 100644
+index 2887b7b288..1d972055de 100644
--- a/package/unzip/unzip.mk
+++ b/package/unzip/unzip.mk
-@@ -11,18 +11,21 @@ UNZIP_LICENSE = Info-ZIP
+@@ -11,21 +11,22 @@ UNZIP_LICENSE = Info-ZIP
UNZIP_LICENSE_FILES = LICENSE
UNZIP_PATCH = \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/07-increase-size-of-cfactorstr.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/08-allow-greater-hostver-values.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/09-cve-2014-8139-crc-overflow.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/11-cve-2014-8141-getzip64data.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/14-cve-2015-7696.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/15-cve-2015-7697.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/17-restore-unix-timestamps-accurately.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
-- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/07-increase-size-of-cfactorstr.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/08-allow-greater-hostver-values.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/09-cve-2014-8139-crc-overflow.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/11-cve-2014-8141-getzip64data.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/14-cve-2015-7696.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/15-cve-2015-7697.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/17-restore-unix-timestamps-accurately.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/21-fix-warning-messages-on-big-files.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch \
-+ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/07-increase-size-of-cfactorstr.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/08-allow-greater-hostver-values.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/09-cve-2014-8139-crc-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/11-cve-2014-8141-getzip64data.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/14-cve-2015-7696.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/15-cve-2015-7697.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/17-restore-unix-timestamps-accurately.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/21-fix-warning-messages-on-big-files.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/07-increase-size-of-cfactorstr.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/08-allow-greater-hostver-values.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/09-cve-2014-8139-crc-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/11-cve-2014-8141-getzip64data.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/14-cve-2015-7696.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/15-cve-2015-7697.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/17-restore-unix-timestamps-accurately.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/21-fix-warning-messages-on-big-files.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-25/debian/patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch
$(eval $(cmake-package))
--
hooks/post-receive
--
armadeus
|
