Skip to contentSkip to conversation

powerpc-utils: security bump to 1.2.24

PATCH New Baruch Siach 2 participants 2 messages Mar 20, 2015

lore
Share & tools
lore

Baruch Siach

author
#0 lore raw

PATCH 1/1 powerpc-utils: security bump to 1.2.24

Fixes CVE-2014-4040: A local attacker could obtain sensitive information from the generated archive such as plain text passwords.

Yes, version 1.2.24 seems to be newer than 1.4, which is equivalent to 1.2.20.

Also, switch from git clone to tarball download , and add a .hash file.

The configure script seems to misdetect stack smashing protection support in the toolchain. gcc accepts -fstack_protector_all, but the linker complains:
"ld: cannot find -lssp".

Cc Jeremy Kerr <[email protected]>
Signed-off-by Baruch Siach <[email protected]>
---
 package/powerpc-utils/powerpc-utils.hash | 3 +++
 package/powerpc-utils/powerpc-utils.mk   | 7 ++++---
 2 files changed, 7 insertions(+), 3 deletions(-)
 create mode 100644 package/powerpc-utils/powerpc-utils.hash
package/powerpc-utils/powerpc-utils.hash new file +3 -0
new file mode 100644
index 000000000000..d02f16ad6ba7
@@ -0,0 +1,3 @@
+# From http://sourceforge.net/projects/powerpc-utils/files/powerpc-utils/
+sha1	975c668e8eaedd5222a7870e82ce295d06dfe649	powerpc-utils-1.2.24.tar.gz
+md5	f492a72f2d4522eba5d9b329c84b3ed3	powerpc-utils-1.2.24.tar.gz
package/powerpc-utils/powerpc-utils.mk +4 -3
index eae58d513e7a..3b30458d3be3 100644
@@ -4,13 +4,14 @@
 #
 ################################################################################
 
-POWERPC_UTILS_VERSION = v1.4
-POWERPC_UTILS_SITE = git://git.code.sf.net/p/powerpc-utils/powerpc-utils
-POWERPC_UTILS_AUTORECONF = YES
+POWERPC_UTILS_VERSION = 1.2.24
+POWERPC_UTILS_SITE = http://downloads.sourceforge.net/project/powerpc-utils/powerpc-utils
 POWERPC_UTILS_DEPENDENCIES = zlib
 POWERPC_UTILS_LICENSE = Common Public License Version 1.0
 POWERPC_UTILS_LICENSE_FILES = COPYRIGHT
 
 POWERPC_UTILS_CONF_OPTS = --without-librtas
+POWERPC_UTILS_CONF_ENV = \
+	ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)
 
 $(eval $(autotools-package))
Signature · 1 line
2.1.4
Applied
#1 lore raw

PATCH 1/1 powerpc-utils: security bump to 1.2.24

Dear Baruch Siach,

Quoted 5 lines · Baruch Siach

Fixes CVE-2014-4040: A local attacker could obtain sensitive information from the generated archive such as plain text passwords.

Yes, version 1.2.24 seems to be newer than 1.4, which is equivalent to 1.2.20.

Quoted 8 lines

Also, switch from git clone to tarball download , and add a .hash file.

The configure script seems to misdetect stack smashing protection support in the toolchain. gcc accepts -fstack_protector_all, but the linker complains:
"ld: cannot find -lssp".

Cc Jeremy Kerr <[email protected]>
Signed-off-by Baruch Siach <[email protected]>

Applied, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com