lighttpd: apply security patches for lighttpd-1.4.33
PATCH 1/1 lighttpd: apply security patches for lighttpd-1.4.33
Apply security patches for lighttpd-1.4.33.
Also rename these patches to follow buildroot's naming scheme.
lighttpd-03-fix_fam_use_after_free.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_fam_use_after_free.patch
lighttpd-04-fix_setuid.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_setuid.patch
lighttpd-05-fix_ssl_sni.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_ssl_sni.patch
--- .../lighttpd-03-fix_fam_use_after_free.patch | 22 ++ package/lighttpd/lighttpd-04-fix_setuid.patch | 43 +++ package/lighttpd/lighttpd-05-fix_ssl_sni.patch | 369 +++++++++++++++++++++ 3 files changed, 434 insertions(+) create mode 100644 package/lighttpd/lighttpd-03-fix_fam_use_after_free.patch create mode 100644 package/lighttpd/lighttpd-04-fix_setuid.patch create mode 100644 package/lighttpd/lighttpd-05-fix_ssl_sni.patch
package/lighttpd/lighttpd-03-fix_fam_use_after_free.patch new file +22 -0
@@ -0,0 +1,22 @@ +commit ae1335503a8f63489f847668ee37df8470a2ab0a +Author: Stefan B?hler <[email protected]> +Date: Wed Nov 13 11:43:28 2013 +0000 + + [stat-cache] FAM: fix use after free (CVE-2013-4560) + + From: Stefan B?hler <[email protected]> + + git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x at 2921 152afb58-edef-0310-8abb-c4023f1b3aa9 + +diff --git a/src/stat_cache.c b/src/stat_cache.c +index e995f3b..924f4dc 100644 +--- a/src/stat_cache.c ++++ b/src/stat_cache.c +@@ -648,6 +648,7 @@ handler_t stat_cache_get_entry(server *srv, connection *con, buffer *name, stat_ + FamErrlist[FAMErrno]); + + fam_dir_entry_free(fam_dir); ++ fam_dir = NULL; + } else { + int osize = 0; +
package/lighttpd/lighttpd-04-fix_setuid.patch new file +43 -0
43 lines not on this page · raw message
package/lighttpd/lighttpd-05-fix_ssl_sni.patch new file +369 -0
369 lines not on this page · raw message
Signature · 1 line
1.8.1.2
PATCH 1/1 lighttpd: apply security patches for lighttpd-1.4.33
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Axel" == Axel Lin <[email protected]> writes:
Apply security patches for lighttpd-1.4.33.
Also rename these patches to follow buildroot's naming scheme.lighttpd-03-fix_fam_use_after_free.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_fam_use_after_free.patch
Quoted 7 lines
lighttpd-04-fix_setuid.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_setuid.patchlighttpd-05-fix_ssl_sni.patch:
http://download.lighttpd.net/lighttpd/security/lighttpd-1.4.33_fix_ssl_sni.patchSigned-off-by Axel Lin <[email protected]>
Committed, thanks.
Signature · 1 line
Bye, Peter Korsgaard