Skip to contentSkip to conversation

tremor: security bump to fix CVE-2018-5146

PATCH New Peter Korsgaard 1 participant 4 messages Mar 19, 2018 – Apr 11, 2018

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 tremor: security bump to fix CVE-2018-5146

Prevent out-of-bounds write in codebook decoding.

Codebooks that are not an exact divisor of the partition size are now truncated to fit within the partition.

Upstream has migrated from subversion to git, so change to git and bump the version to include the fix for CVE-2018-5146.

While we're at it, also add a hash file.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/tremor/tremor.hash | 3 +++
 package/tremor/tremor.mk   | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)
 create mode 100644 package/tremor/tremor.hash
package/tremor/tremor.hash new file +3 -0
new file mode 100644
index 0000000000..89661a64cd
@@ -0,0 +1,3 @@
+# Locally computed
+sha256 ba94cfdf886399c550f76908285bfa9e322f24085de6f1810c2abea565c13a15  tremor-7c30a66346199f3f09017a09567c6c8a3a0eedc8.tar.gz
+sha256 d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814  COPYING
package/tremor/tremor.mk +3 -3
index 05996e2a8a..835fe36172 100644
@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-TREMOR_SITE = http://svn.xiph.org/trunk/Tremor
-TREMOR_SITE_METHOD = svn
-TREMOR_VERSION = 19427
+TREMOR_VERSION = 7c30a66346199f3f09017a09567c6c8a3a0eedc8
+TREMOR_SITE = https://git.xiph.org/tremor.git
+TREMOR_SITE_METHOD = git
 TREMOR_LICENSE = BSD-3-Clause
 TREMOR_LICENSE_FILES = COPYING
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/1 tremor: security bump to fix CVE-2018-5146

Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Prevent out-of-bounds write in codebook decoding. Codebooks that are not an exact divisor of the partition size are now truncated to fit within the partition.

Quoted 6 lines

Upstream has migrated from subversion to git, so change to git and bump the version to include the fix for CVE-2018-5146.

While we're at it, also add a hash file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 tremor: security bump to fix CVE-2018-5146

In reply to Peter Korsgaard
Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Prevent out-of-bounds write in codebook decoding. Codebooks that are not an exact divisor of the partition size are now truncated to fit within the partition.

Quoted 6 lines

Upstream has migrated from subversion to git, so change to git and bump the version to include the fix for CVE-2018-5146.

While we're at it, also add a hash file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2018.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#3 lore raw

PATCH 1/1 tremor: security bump to fix CVE-2018-5146

In reply to Peter Korsgaard
Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Prevent out-of-bounds write in codebook decoding. Codebooks that are not an exact divisor of the partition size are now truncated to fit within the partition.

Quoted 6 lines

Upstream has migrated from subversion to git, so change to git and bump the version to include the fix for CVE-2018-5146.

While we're at it, also add a hash file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard