Skip to contentSkip to conversation

jethro-next Foomatic-filter security fixes

PATCH New Armin Kuster 1 participant 3 messages Feb 1, 2016

lore
Share & tools
lore

Armin Kuster

author
#0 lore raw

cover jethro-next Foomatic-filter security fixes

From: Armin Kuster <[email protected]>

Please consider these for an upcoming release

The following changes since commit fbfe937ab7effcacd1dae558a667eaa0e0500637:

git: Security fix CVE-2015-7545 (2016-01-31 14:28:42 -0800)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib akuster/jethro_cve_fixes
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=akuster/jethro_cve_fixes

Armin Kuster (2):
foomatic-filters: Security fix CVE-2015-8560
foomatic-filters: Security fixes CVE-2015-8327

 .../foomatic-filters-4.0.17/CVE-2015-8327.patch    | 23 ++++++++++++++++++++++
 .../foomatic-filters-4.0.17/CVE-2015-8560.patch    | 23 ++++++++++++++++++++++
 .../foomatic/foomatic-filters_4.0.17.bb            |  3 +++
 3 files changed, 49 insertions(+)
 create mode 100644 meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8327.patch
 create mode 100644 meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch
Signature · 1 line
2.3.5
author
#1 lore raw

PATCH 1/2 foomatic-filters: Security fix CVE-2015-8560

From: Armin Kuster <[email protected]>

CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character

Signed-off-by Armin Kuster <[email protected]>
---
 .../foomatic-filters-4.0.17/CVE-2015-8560.patch    | 23 ++++++++++++++++++++++
 .../foomatic/foomatic-filters_4.0.17.bb            |  3 +++
 2 files changed, 26 insertions(+)
 create mode 100644 meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch
meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch new file +23 -0
new file mode 100644
index 0000000..dc973c4
@@ -0,0 +1,23 @@
+Upstream-Status: Backport
+
+
+http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7419
+
+Hand applied change to util.c. Fix was for cups-filters but also applied to foomatic-filters.
+
+CVE: CVE-2015-8560
+Signed-off-by: Armin Kuster <[email protected]>
+
+Index: util.c
+===================================================================
+--- a/util.c
++++ b/util.c
+@@ -31,7 +31,7 @@
+ #include <assert.h>
+ 
+ 
+-const char* shellescapes = "|<>&!$\'\"#*?()[]{}";
++const char* shellescapes = "|;<>&!$\'\"#*?()[]{}";
+ 
+ const char * temp_dir()
+ {
meta/recipes-extended/foomatic/foomatic-filters_4.0.17.bb +3 -0
index 790c981..7d0d717 100644
@@ -17,6 +17,9 @@ LIC_FILES_CHKSUM = "file://${WORKDIR}/foomatic-filters-${PV}/COPYING;md5=393a5ca
 
 SRC_URI = "http://www.openprinting.org/download/foomatic/foomatic-filters-${PV}.tar.gz"
 
+SRC_URI += "file://CVE-2015-8560.patch \
+           "
+
 SRC_URI[md5sum] = "b05f5dcbfe359f198eef3df5b283d896"
 SRC_URI[sha256sum] = "a2e2e53e502571e88eeb9010c45a0d54671f15707ee104f5c9c22b59ea7a33e3"
Signature · 1 line
2.3.5
author
#2 lore raw

PATCH 2/2 foomatic-filters: Security fixes CVE-2015-8327

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

CVE-2015-8327 cups-filters: foomatic-rip did not consider the back tick as an illegal shell escape character

Signed-off-by Armin Kuster <[email protected]>
---
 .../foomatic-filters-4.0.17/CVE-2015-8327.patch    | 23 ++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8327.patch
meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8327.patch new file +23 -0
new file mode 100644
index 0000000..aaedc88
@@ -0,0 +1,23 @@
+Upstream-Status: Backport
+
+
+http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7406
+
+Hand applied change to util.c. Fix was for cups-filters but also applied to foomatic-filters.
+
+CVE: CVE-2015-8327
+Signed-off-by: Armin Kuster <[email protected]>
+
+Index: util.c
+===================================================================
+--- a/util.c
++++ b/util.c
+@@ -31,7 +31,7 @@
+ #include <assert.h>
+ 
+ 
+-const char* shellescapes = "|;<>&!$\'\"#*?()[]{}";
++const char* shellescapes = "|;<>&!$\'\"`#*?()[]{}";
+ 
+ const char * temp_dir()
+ {
Signature · 1 line
2.3.5