squid: serveral missing security fixes
PATCH 1/1 squid: serveral missing security fixes
From: Armin Kuster <[email protected]>
SQUID-2015:2 - Squid-3.4 and older versions are not vulnerable. CVE-2015-5400
CVE-2015-3455
CVE-2014-7142
CVE-2014-7141
CVE-2014-6270
see http://www.squid-cache.org/Advisories/
Signed-off-by Armin Kuster <[email protected]>
--- .../squid/files/CVE-2014-6270.patch | 61 +++++ .../squid/files/CVE-2014-7141_CVE-2014-7142.patch | 282 ++++++++++++++++++++ .../squid/files/CVE-2015-3455.patch | 53 ++++ .../squid/files/CVE-2015-5400.patch | 292 +++++++++++++++++++++ .../recipes-daemons/squid/squid_3.4.7.bb | 4 + 5 files changed, 692 insertions(+) create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2014-6270.patch create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2014-7141_CVE-2014-7142.patch create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2015-3455.patch create mode 100644 meta-networking/recipes-daemons/squid/files/CVE-2015-5400.patch
meta-networking/recipes-daemons/squid/files/CVE-2014-6270.patch new file +61 -0
@@ -0,0 +1,61 @@ +Fix: CVE-2014-3609 + +revno: 13172 +revision-id: [email protected] +parent: [email protected] +author: Sebastian Krahmer <[email protected]> +committer: Amos Jeffries <[email protected]> +branch nick: 3.4 +timestamp: Sun 2014-09-14 22:58:34 -0600 +message: + Fix off by one in SNMP subsystem +------------------------------------------------------------ +# Bazaar merge directive format 2 (Bazaar 0.90) +# revision_id: [email protected] +# target_branch: http://bzr.squid-cache.org/bzr/squid3/3.4 +# testament_sha1: 72ffc18d9c25a0412efc813dc5cde1c63e8ebe46 +# timestamp: 2014-09-15 11:08:17 +0000 +# source_branch: http://bzr.squid-cache.org/bzr/squid3/3.4 +# base_revision_id: [email protected]\ +# n6y0r0iuv4sq6hvg +# +# Begin patch + +Upstream-Status: Backport + +http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13172.patch + +Signed-of-by: Armin Kuster <[email protected]> + +=== modified file 'src/snmp_core.cc' +--- a/src/snmp_core.cc 2014-02-18 08:46:49 +0000 ++++ b/src/snmp_core.cc 2014-09-15 04:58:34 +0000 +@@ -362,7 +362,7 @@ + void + snmpHandleUdp(int sock, void *not_used) + { +- LOCAL_ARRAY(char, buf, SNMP_REQUEST_SIZE); ++ static char buf[SNMP_REQUEST_SIZE]; + Ip::Address from; + SnmpRequest *snmp_rq; + int len; +@@ -371,16 +371,11 @@ + + Comm::SetSelect(sock, COMM_SELECT_READ, snmpHandleUdp, NULL, 0); + +- memset(buf, '\0', SNMP_REQUEST_SIZE); ++ memset(buf, '\0', sizeof(buf)); + +- len = comm_udp_recvfrom(sock, +- buf, +- SNMP_REQUEST_SIZE, +- 0, +- from); ++ len = comm_udp_recvfrom(sock, buf, sizeof(buf)-1, 0, from); + + if (len > 0) { +- buf[len] = '\0'; + debugs(49, 3, "snmpHandleUdp: FD " << sock << ": received " << len << " bytes from " << from << "."); + + snmp_rq = (SnmpRequest *)xcalloc(1, sizeof(SnmpRequest)); +
meta-networking/recipes-daemons/squid/files/CVE-2014-7141_CVE-2014-7142.patch new file +282 -0
282 lines not on this page · raw message
meta-networking/recipes-daemons/squid/files/CVE-2015-3455.patch new file +53 -0
53 lines not on this page · raw message
meta-networking/recipes-daemons/squid/files/CVE-2015-5400.patch new file +292 -0
292 lines not on this page · raw message
meta-networking/recipes-daemons/squid/squid_3.4.7.bb +4 -0
@@ -20,6 +20,10 @@ SRC_URI = "http://www.squid-cache.org/Versions/v${MAJ_VER}/${MIN_VER}/${BPN}-${P file://squid-use-serial-tests-config-needed-by-ptest.patch \ file://run-ptest \ file://volatiles.03_squid \ + file://CVE-2014-6270.patch \ + file://CVE-2014-7141_CVE-2014-7142.patch \ + file://CVE-2015-3455.patch \ + file://CVE-2015-5400.patch \ " LIC_FILES_CHKSUM = "file://COPYING;md5=c492e2d6d32ec5c1aad0e0609a141ce9 \
Signature · 1 line
2.3.5