Skip to contentSkip to conversation

libzip: security bump to version 1.3.0

PATCH New Peter Korsgaard 1 participant 3 messages Sep 7, 2017 – Oct 16, 2017

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 libzip: security bump to version 1.3.0

Fixes the following security issues:

CVE-2017-12858: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.

CVE-2017-14107: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

For more details, see
https://blogs.gentoo.org/ago/2017/09/01/libzip-use-after-free-in-_zip_buffer_free-zip_buffer-c/
https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/

libzip-1.3.0 also adds optional bzip2 support, so handle that.

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/libzip/libzip.hash | 3 ++-
 package/libzip/libzip.mk   | 9 ++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)
package/libzip/libzip.hash +2 -1
index 103c7619e2..d100982bc6 100644
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256	ffc0764395fba3d45dc5a6e32282788854618b9e9838337f8218b596007f1376	libzip-1.2.0.tar.xz
+sha256	aa936efe34911be7acac2ab07fb5c8efa53ed9bb4d44ad1fe8bff19630e0d373  libzip-1.3.0.tar.xz
+sha256  d159ae325ca0b8236c44dfd980ca99810dbcfc057b077c50dbbda1131cbd263a  LICENSE
package/libzip/libzip.mk +8 -1
index a4012dd1e3..5ffa1cac00 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBZIP_VERSION = 1.2.0
+LIBZIP_VERSION = 1.3.0
 LIBZIP_SITE = http://www.nih.at/libzip
 LIBZIP_SOURCE = libzip-$(LIBZIP_VERSION).tar.xz
 LIBZIP_LICENSE = BSD-3-Clause

@@ -12,4 +12,11 @@ LIBZIP_LICENSE_FILES = LICENSE
 LIBZIP_INSTALL_STAGING = YES
 LIBZIP_DEPENDENCIES = zlib
 
+ifeq ($(BR2_PACKAGE_BZIP2),y)
+LIBZIP_CONF_OPTS += --with-bzip2
+LIBZIP_DEPENDENCIES += bzip2
+else
+LIBZIP_CONF_OPTS += --without-bzip2
+endif
+
 $(eval $(autotools-package))
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/1 libzip: security bump to version 1.3.0

Quoted 16 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
CVE-2017-12858: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.

CVE-2017-14107: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

For more details, see
https://blogs.gentoo.org/ago/2017/09/01/libzip-use-after-free-in-_zip_buffer_free-zip_buffer-c/
https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/

Quoted 5 lines

libzip-1.3.0 also adds optional bzip2 support, so handle that.

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 libzip: security bump to version 1.3.0

In reply to Peter Korsgaard
Quoted 16 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
CVE-2017-12858: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.

CVE-2017-14107: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.

For more details, see
https://blogs.gentoo.org/ago/2017/09/01/libzip-use-after-free-in-_zip_buffer_free-zip_buffer-c/
https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/

Quoted 5 lines

libzip-1.3.0 also adds optional bzip2 support, so handle that.

While we're at it, add a hash for the license file.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard