[Armadeus-commitlog] armadeus branch, master, updated. armadeus-7.0-322-ge8bbe8f46
Brought to you by:
sszy
Menu
▾
▴
[Armadeus-commitlog] armadeus branch, master, updated. armadeus-7.0-322-ge8bbe8f46
|
From: Sébastien S. <ss...@us...> - 2022-03-01 15:18:23
|
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "armadeus".
The branch, master has been updated
via e8bbe8f46c14feee059ac9c702a37e8e1d6847ac (commit)
via e973548f8bf9ee335ee4f3ff45693694d83f6696 (commit)
via 1c4b013e6aa1fb65d699a0912f37cc39f848a5ad (commit)
from 3297d7542a085ad0c8e1af3d04d59b39b4ff6c2b (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit e8bbe8f46c14feee059ac9c702a37e8e1d6847ac
Author: Sébastien Szymanski <seb...@ar...>
Date: Tue Mar 1 16:00:19 2022 +0100
[BUILDROOT] 2021.02: patches for expat
Fixes expat downloading
commit e973548f8bf9ee335ee4f3ff45693694d83f6696
Author: Sébastien Szymanski <seb...@ar...>
Date: Tue Mar 1 14:40:43 2022 +0100
[BUILDROOT] Bump BR to 2021.02.10
commit 1c4b013e6aa1fb65d699a0912f37cc39f848a5ad
Author: Sébastien Szymanski <seb...@ar...>
Date: Tue Mar 1 14:39:22 2022 +0100
[BUILDROOT] 2021.02: cleanup_buildroot.sh: remove pwmmusic
-----------------------------------------------------------------------
Summary of changes:
Makefile | 2 +-
...kage-expat-security-bump-to-version-2.4.5.patch | 78 ++++++++++++++++++++++
.../420-package-expat-bump-to-version-2.4.6.patch | 50 ++++++++++++++
patches/buildroot/2021.02/cleanup_buildroot.sh | 4 ++
4 files changed, 133 insertions(+), 1 deletion(-)
create mode 100644 patches/buildroot/2021.02/419-package-expat-security-bump-to-version-2.4.5.patch
create mode 100644 patches/buildroot/2021.02/420-package-expat-bump-to-version-2.4.6.patch
diff --git a/Makefile b/Makefile
index 4dedd4a78..f357a5548 100644
--- a/Makefile
+++ b/Makefile
@@ -27,7 +27,7 @@ export ARMADEUS_TOPDIR
#--- User configurable stuff:
BUILDROOT_MAJOR_VERSION ?= 2021.02
-BUILDROOT_MINOR_VERSION ?= 9
+BUILDROOT_MINOR_VERSION ?= 10
ifneq ($(strip $(BUILDROOT_MINOR_VERSION)),)
BUILDROOT_VERSION := $(BUILDROOT_MAJOR_VERSION).$(BUILDROOT_MINOR_VERSION)
else
diff --git a/patches/buildroot/2021.02/419-package-expat-security-bump-to-version-2.4.5.patch b/patches/buildroot/2021.02/419-package-expat-security-bump-to-version-2.4.5.patch
new file mode 100644
index 000000000..136d8a74a
--- /dev/null
+++ b/patches/buildroot/2021.02/419-package-expat-security-bump-to-version-2.4.5.patch
@@ -0,0 +1,78 @@
+From 21c07c0aaa7e43b8f676c564f173a510d345a77a Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fon...@gm...>
+Date: Sat, 19 Feb 2022 13:28:31 +0100
+Subject: [PATCH 1/2] package/expat: security bump to version 2.4.5
+
+Security fixes:
+ #562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
+ sequences (e.g. from start tag names) to the XML
+ processing application on top of Expat can cause
+ arbitrary damage (e.g. code execution) depending
+ on how invalid UTF-8 is handled inside the XML
+ processor; validation was not their job but Expat's.
+ Exploits with code execution are known to exist.
+ #561 CVE-2022-25236 -- Passing (one or more) namespace separator
+ characters in "xmlns[:prefix]" attribute values
+ made Expat send malformed tag names to the XML
+ processor on top of Expat which can cause
+ arbitrary damage (e.g. code execution) depending
+ on such unexpectable cases are handled inside the XML
+ processor; validation was not their job but Expat's.
+ Exploits with code execution are known to exist.
+ #558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
+ that could be triggered by e.g. a 2 megabytes
+ file with a large number of opening braces.
+ Expected impact is denial of service or potentially
+ arbitrary code execution.
+ #560 CVE-2022-25314 -- Fix integer overflow in function copyString;
+ only affects the encoding name parameter at parser creation
+ time which is often hardcoded (rather than user input),
+ takes a value in the gigabytes to trigger, and a 64-bit
+ machine. Expected impact is denial of service.
+ #559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
+ needs input in the gigabytes and a 64-bit machine.
+ Expected impact is denial of service or potentially
+ arbitrary code execution.
+
+https://blog.hartwork.org/posts/expat-2-4-5-released/
+https://github.com/libexpat/libexpat/blob/R_2_4_5/expat/Changes
+
+Signed-off-by: Fabrice Fontaine <fon...@gm...>
+Signed-off-by: Yann E. MORIN <yan...@fr...>
+---
+ package/expat/expat.hash | 8 ++++----
+ package/expat/expat.mk | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/package/expat/expat.hash b/package/expat/expat.hash
+index 10e13206d0..cd2e8c7fb9 100644
+--- a/package/expat/expat.hash
++++ b/package/expat/expat.hash
+@@ -1,7 +1,7 @@
+-# From https://sourceforge.net/projects/expat/files/expat/2.4.4/
+-md5 a712d23b7afb32e7527cf0b3fd8f12ac expat-2.4.4.tar.xz
+-sha1 6028b04d3505fc519c4c7c6bd67e1ad1a08cd7b6 expat-2.4.4.tar.xz
++# From https://sourceforge.net/projects/expat/files/expat/2.4.5/
++md5 9dc183e6c1eebc1b658c1e71be0885e1 expat-2.4.5.tar.xz
++sha1 360a49b55c442e91cb7b328bc0335083909ddf4f expat-2.4.5.tar.xz
+
+ # Locally calculated
+-sha256 b5d25d6e373351c2ed19b562b4732d01d2589ac8c8e9e7962d8df1207cc311b8 expat-2.4.4.tar.xz
++sha256 f2af8fc7cdc63a87920da38cd6d12cb113c3c3a3f437495b1b6541e0cff32579 expat-2.4.5.tar.xz
+ sha256 8c6b5b6de8fae20b317f4992729abc0e520bfba4c7606cd1e9eeb87418eebdec COPYING
+diff --git a/package/expat/expat.mk b/package/expat/expat.mk
+index 250600c25e..7815d61027 100644
+--- a/package/expat/expat.mk
++++ b/package/expat/expat.mk
+@@ -4,7 +4,7 @@
+ #
+ ################################################################################
+
+-EXPAT_VERSION = 2.4.4
++EXPAT_VERSION = 2.4.5
+ EXPAT_SITE = http://downloads.sourceforge.net/project/expat/expat/$(EXPAT_VERSION)
+ EXPAT_SOURCE = expat-$(EXPAT_VERSION).tar.xz
+ EXPAT_INSTALL_STAGING = YES
+--
+2.34.1
+
diff --git a/patches/buildroot/2021.02/420-package-expat-bump-to-version-2.4.6.patch b/patches/buildroot/2021.02/420-package-expat-bump-to-version-2.4.6.patch
new file mode 100644
index 000000000..b73a26e0c
--- /dev/null
+++ b/patches/buildroot/2021.02/420-package-expat-bump-to-version-2.4.6.patch
@@ -0,0 +1,50 @@
+From 46390b3a7c47420b7523b8f18276f3ccd49940c7 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fon...@gm...>
+Date: Sun, 20 Feb 2022 21:47:22 +0100
+Subject: [PATCH 2/2] package/expat: bump to version 2.4.6
+
+This release fixes a regression introduced by one of the security fixes
+in 2.4.5.
+
+https://blog.hartwork.org/posts/expat-2-4-6-released
+https://github.com/libexpat/libexpat/blob/R_2_4_6/expat/Changes
+
+Signed-off-by: Fabrice Fontaine <fon...@gm...>
+Signed-off-by: Peter Korsgaard <pe...@ko...>
+---
+ package/expat/expat.hash | 8 ++++----
+ package/expat/expat.mk | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/package/expat/expat.hash b/package/expat/expat.hash
+index cd2e8c7fb9..0d9f60931f 100644
+--- a/package/expat/expat.hash
++++ b/package/expat/expat.hash
+@@ -1,7 +1,7 @@
+-# From https://sourceforge.net/projects/expat/files/expat/2.4.5/
+-md5 9dc183e6c1eebc1b658c1e71be0885e1 expat-2.4.5.tar.xz
+-sha1 360a49b55c442e91cb7b328bc0335083909ddf4f expat-2.4.5.tar.xz
++# From https://sourceforge.net/projects/expat/files/expat/2.4.6/
++md5 22a30c888752fdda9f8dd1b7281c54b0 expat-2.4.6.tar.xz
++sha1 26e223c4795c242814b0e3299a5027c22b9dc733 expat-2.4.6.tar.xz
+
+ # Locally calculated
+-sha256 f2af8fc7cdc63a87920da38cd6d12cb113c3c3a3f437495b1b6541e0cff32579 expat-2.4.5.tar.xz
++sha256 de55794b7a9bc214852fdc075beaaecd854efe1361597e6268ee87946951289b expat-2.4.6.tar.xz
+ sha256 8c6b5b6de8fae20b317f4992729abc0e520bfba4c7606cd1e9eeb87418eebdec COPYING
+diff --git a/package/expat/expat.mk b/package/expat/expat.mk
+index 7815d61027..c481b5c225 100644
+--- a/package/expat/expat.mk
++++ b/package/expat/expat.mk
+@@ -4,7 +4,7 @@
+ #
+ ################################################################################
+
+-EXPAT_VERSION = 2.4.5
++EXPAT_VERSION = 2.4.6
+ EXPAT_SITE = http://downloads.sourceforge.net/project/expat/expat/$(EXPAT_VERSION)
+ EXPAT_SOURCE = expat-$(EXPAT_VERSION).tar.xz
+ EXPAT_INSTALL_STAGING = YES
+--
+2.34.1
+
diff --git a/patches/buildroot/2021.02/cleanup_buildroot.sh b/patches/buildroot/2021.02/cleanup_buildroot.sh
index 56fb8e557..ac538bc6e 100755
--- a/patches/buildroot/2021.02/cleanup_buildroot.sh
+++ b/patches/buildroot/2021.02/cleanup_buildroot.sh
@@ -31,6 +31,8 @@ rm -rf buildroot/package/cmux/cmux.hash
rm -rf buildroot/package/cmux/cmux.mk
rm -rf buildroot/package/e-uae/Config.in
rm -rf buildroot/package/e-uae/e-uae.mk
+rm -rf buildroot/package/expat/expat.hash
+rm -rf buildroot/package/expat/expat.mk
rm -rf buildroot/package/expect/expect.mk
rm -rf buildroot/package/fb-test-app/001-fixes-tty-vc-config-on-fb-test-exit.patch
rm -rf buildroot/package/freescale-imx/Config.in
@@ -102,6 +104,8 @@ rm -rf buildroot/package/pci_debug/pci_debug.mk
rm -rf buildroot/package/pcre/0002-Disable-C-unit-tests.patch
rm -rf buildroot/package/pcre/pcre.hash
rm -rf buildroot/package/pcre/pcre.mk
+rm -rf buildroot/package/pwmmusic/Config.in
+rm -rf buildroot/package/pwmmusic/pwmmusic.mk
rm -rf buildroot/package/python-flask-socketio/Config.in
rm -rf buildroot/package/python-flask-socketio/python-flask-socketio.hash
rm -rf buildroot/package/python-flask-socketio/python-flask-socketio.mk
hooks/post-receive
--
armadeus
|