Skip to contentSkip to conversation

libksba: security bump to version 1.3.3

PATCH New Gustavo Zacarias 2 participants 2 messages Apr 13, 2015 – Apr 14, 2015

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 libksba: security bump to version 1.3.3

Fixes (no CVEs assigned yet):

* integer overflow in the DN decoder src/dn.c (append_quoted, append_atv)

* integer overflow in the BER decoder src/ber-decoder.c (ber_decoder_s)

* denial of service due to stack overflow in src/ber-decoder.c (push_decoder_state, pop_decoder_state)

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/libksba/libksba.hash | 4 ++--
 package/libksba/libksba.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/libksba/libksba.hash +2 -2
index 3bd6ef0..f7727f1 100644
@@ -1,2 +1,2 @@
-# From http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html
-sha1	37d0893a587354af2b6e49f6ae701ca84f52da67	libksba-1.3.2.tar.bz2
+# Locally calculated after checking pgp signature
+sha256	0c7f5ffe34d0414f6951d9880a46fcc2985c487f7c36369b9f11ad41131c7786	libksba-1.3.3.tar.bz2
package/libksba/libksba.mk +1 -1
index b48cac5..7651534 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBKSBA_VERSION = 1.3.2
+LIBKSBA_VERSION = 1.3.3
 LIBKSBA_SOURCE = libksba-$(LIBKSBA_VERSION).tar.bz2
 LIBKSBA_SITE = ftp://ftp.gnupg.org/gcrypt/libksba
 LIBKSBA_LICENSE = LGPLv3+ or GPLv2+ (library, headers), GPLv3+ (manual, tests, build system)
Signature · 1 line
2.0.5
Applied
#1 lore raw

PATCH 1/1 libksba: security bump to version 1.3.3

Dear Gustavo Zacarias,

Quoted 7 lines · Gustavo Zacarias

Fixes (no CVEs assigned yet):

* integer overflow in the DN decoder src/dn.c (append_quoted, append_atv)

* integer overflow in the BER decoder src/ber-decoder.c (ber_decoder_s)

Quoted 8 lines

* denial of service due to stack overflow in src/ber-decoder.c (push_decoder_state, pop_decoder_state)

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/libksba/libksba.hash | 4 ++--
 package/libksba/libksba.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

Applied, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com