gdk-pixbuf: security bump to version 2.36.10

PATCH New Peter Korsgaard 1 participant 4 messages Sep 21, 2017 – Oct 16, 2017

lore

Share & tools

lore

Peter Korsgaard

author

2017-09-21 07:04 UTC #0 lore raw

PATCH 1/1 gdk-pixbuf: security bump to version 2.36.10

Fixes the following security issues:

CVE-2017-2862 - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.

CVE-2017-2870 - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.

CVE-2017-6311 - gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.

The host version now needs the same workaround as we do for the target to not pull in shared-mime-info.

Also add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

---
 package/gdk-pixbuf/gdk-pixbuf.hash | 6 ++++--
 package/gdk-pixbuf/gdk-pixbuf.mk   | 5 ++++-
 2 files changed, 8 insertions(+), 3 deletions(-)

package/gdk-pixbuf/gdk-pixbuf.hash +4 -2

index ebb03a8684..9cb947f195 100644
@@ -1,2 +1,4 @@
-# From http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.36/gdk-pixbuf-2.36.6.sha256sum
-sha256 455eb90c09ed1b71f95f3ebfe1c904c206727e0eeb34fc94e5aaf944663a820c  gdk-pixbuf-2.36.6.tar.xz
+# From http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/2.36/gdk-pixbuf-2.36.10.sha256sum
+sha256 f8f6fa896b89475c73b6e9e8d2a2b062fc359c4b4ccb8e96470d6ab5da949ace  gdk-pixbuf-2.36.10.tar.xz
+# Locally calculated
+sha256 d245807f90032872d1438d741ed21e2490e1175dc8aa3afa5ddb6c8e529b58e5  COPYING

package/gdk-pixbuf/gdk-pixbuf.mk +4 -1

index ac92e23c18..e36761cb8d 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 GDK_PIXBUF_VERSION_MAJOR = 2.36
-GDK_PIXBUF_VERSION = $(GDK_PIXBUF_VERSION_MAJOR).6
+GDK_PIXBUF_VERSION = $(GDK_PIXBUF_VERSION_MAJOR).10
 GDK_PIXBUF_SOURCE = gdk-pixbuf-$(GDK_PIXBUF_VERSION).tar.xz
 GDK_PIXBUF_SITE = http://ftp.gnome.org/pub/gnome/sources/gdk-pixbuf/$(GDK_PIXBUF_VERSION_MAJOR)
 GDK_PIXBUF_LICENSE = LGPL-2.0+

@@ -20,6 +20,9 @@ GDK_PIXBUF_CONF_ENV = \
 	ac_cv_path_GLIB_GENMARSHAL=$(LIBGLIB2_HOST_BINARY) \
 	gio_can_sniff=no
 
+HOST_GDK_PIXBUF_CONF_ENV = \
+	gio_can_sniff=no
+
 GDK_PIXBUF_CONF_OPTS = --disable-glibtest
 
 ifneq ($(BR2_PACKAGE_LIBPNG),y)

Signature · 1 line

2.11.0

Peter Korsgaard

author

2017-09-21 19:33 UTC #1 lore raw

PATCH 1/1 gdk-pixbuf: security bump to version 2.36.10

Quoted 20 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
CVE-2017-2862 - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.
CVE-2017-2870 - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.
CVE-2017-6311 - gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.

Quoted 6 lines

The host version now needs the same workaround as we do for the target to not pull in shared-mime-info.
Also add a hash for the license file while we're at it.
Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2017-09-22 07:48 UTC #2 lore raw

PATCH 1/1 gdk-pixbuf: security bump to version 2.36.10

In reply to Peter Korsgaard

Quoted 20 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
CVE-2017-2862 - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.
CVE-2017-2870 - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.
CVE-2017-6311 - gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.

Quoted 6 lines

The host version now needs the same workaround as we do for the target to not pull in shared-mime-info.
Also add a hash for the license file while we're at it.
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Peter Korsgaard

author

2017-10-16 22:01 UTC #3 lore raw

PATCH 1/1 gdk-pixbuf: security bump to version 2.36.10

In reply to Peter Korsgaard

Quoted 20 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
CVE-2017-2862 - An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.
CVE-2017-2870 - An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution. An attacker can send a file or a URL to trigger this vulnerability.
CVE-2017-6311 - gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error message.

Quoted 6 lines

The host version now needs the same workaround as we do for the target to not pull in shared-mime-info.
Also add a hash for the license file while we're at it.
Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard