binutils: fix CVE-2019-12972 CVE-2019-9071

PATCH In review Anuj Mittal 2 participants 4 messages Jul 10, 2019

lore

Share & tools

lore

Anuj Mittal

author

2019-07-10 02:37 UTC #0 lore raw

PATCH 1/3 binutils: fix CVE-2019-12972 CVE-2019-9071

Signed-off-by Anuj Mittal <[email protected]>

---
 .../binutils/binutils-2.32.inc                |   2 +
 .../binutils/binutils/CVE-2019-12972.patch    |  51 ++++++
 .../binutils/binutils/CVE-2019-9071.patch     | 164 ++++++++++++++++++
 3 files changed, 217 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2019-12972.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch

meta/recipes-devtools/binutils/binutils-2.32.inc +2 -0

index 49e6827c1f..31c24a37f5 100644
@@ -48,6 +48,8 @@ SRC_URI = "\
      file://CVE-2019-9075.patch \
      file://CVE-2019-9076.patch \
      file://CVE-2019-9077.patch \
+     file://CVE-2019-9071.patch \
+     file://CVE-2019-12972.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2019-12972.patch new file +51 -0

51 lines not on this page · raw message

meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch new file +164 -0

164 lines not on this page · raw message

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-10 02:37 UTC #1 lore raw

PATCH 2/3 gnupg: upgrade 2.2.16 -> 2.2.17

Also fixes CVE-2019-13050. Announcement:

https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html

Signed-off-by Anuj Mittal <[email protected]>

---
 .../gnupg/{gnupg_2.2.16.bb => gnupg_2.2.17.bb}               | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
 rename meta/recipes-support/gnupg/{gnupg_2.2.16.bb => gnupg_2.2.17.bb} (92%)

meta/recipes-support/gnupg/gnupg_2.2.17.bb renamed from meta/recipes-support/gnupg/gnupg_2.2.16.bb +2 -3

similarity index 92%
rename from meta/recipes-support/gnupg/gnupg_2.2.16.bb
rename to meta/recipes-support/gnupg/gnupg_2.2.17.bb
index cb7c6c5c62..e5456dd9b9 100644
@@ -19,9 +19,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
 SRC_URI_append_class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \
                                 file://relocate.patch"
 
-
-SRC_URI[md5sum] = "d90e186df1c06845880ea58a318f070b"
-SRC_URI[sha256sum] = "6cbe8d454bf5dc204621eed3016d721b66298fa95363395bb8eeceb1d2fd14cb"
+SRC_URI[md5sum] = "1ba2d9b70c377f8e967742064c27a19c"
+SRC_URI[sha256sum] = "afa262868e39b651a2db4c071fba90415154243e83a830ca00516f9a807fd514"
 
 EXTRA_OECONF = "--disable-ldap \
 		--disable-ccid-driver \

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-10 02:37 UTC #2 lore raw

PATCH 3/3 libxslt: fix CVE-2019-13117 CVE-2019-13118

In reply to Anuj Mittal

Signed-off-by Anuj Mittal <[email protected]>

---
 .../libxslt/files/CVE-2019-13117.patch        | 33 ++++++++
 .../libxslt/files/CVE-2019-13118.patch        | 76 +++++++++++++++++++
 .../recipes-support/libxslt/libxslt_1.1.33.bb |  2 +
 3 files changed, 111 insertions(+)
 create mode 100644 meta/recipes-support/libxslt/files/CVE-2019-13117.patch
 create mode 100644 meta/recipes-support/libxslt/files/CVE-2019-13118.patch

meta/recipes-support/libxslt/files/CVE-2019-13117.patch new file +33 -0

new file mode 100644
index 0000000000..ef3f2709f7
@@ -0,0 +1,33 @@
+From c5eb6cf3aba0af048596106ed839b4ae17ecbcb1 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <[email protected]>
+Date: Sat, 27 Apr 2019 11:19:48 +0200
+Subject: [PATCH] Fix uninitialized read of xsl:number token
+
+Found by OSS-Fuzz.
+
+CVE: CVE-2019-13117
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1]
+Signed-off-by: Anuj Mittal <[email protected]>
+---
+ libxslt/numbers.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libxslt/numbers.c b/libxslt/numbers.c
+index 89e1f668..75c31eba 100644
+--- a/libxslt/numbers.c
++++ b/libxslt/numbers.c
+@@ -382,7 +382,10 @@ xsltNumberFormatTokenize(const xmlChar *format,
+ 		tokens->tokens[tokens->nTokens].token = val - 1;
+ 		ix += len;
+ 		val = xmlStringCurrentChar(NULL, format+ix, &len);
+-	    }
++	    } else {
++                tokens->tokens[tokens->nTokens].token = (xmlChar)'0';
++                tokens->tokens[tokens->nTokens].width = 1;
++            }
+ 	} else if ( (val == (xmlChar)'A') ||
+ 		    (val == (xmlChar)'a') ||
+ 		    (val == (xmlChar)'I') ||
+-- 
+2.21.0
+

meta/recipes-support/libxslt/files/CVE-2019-13118.patch new file +76 -0

76 lines not on this page · raw message

meta/recipes-support/libxslt/libxslt_1.1.33.bb +2 -0

index 6320a821dc..abc00a09ea 100644
@@ -10,6 +10,8 @@ DEPENDS = "libxml2"
 
 SRC_URI = "http://xmlsoft.org/sources/libxslt-${PV}.tar.gz \
            file://0001-Fix-security-framework-bypass.patch \
+           file://CVE-2019-13117.patch \
+           file://CVE-2019-13118.patch \
 "
 
 SRC_URI[md5sum] = "b3bd254a03e46d58f8ad1e4559cd2c2f"

Signature · 1 line

2.20.1

Patchwork

2019-07-10 03:01 UTC #3 lore raw

✗ patchtest: failure for "binutils: fix CVE-2019-12972 C..." and 2 more

In reply to Anuj Mittal

== Series Details ==

Series: "binutils: fix CVE-2019-12972 C..." and 2 more
Revision: 1
URL : https://patchwork.openembedded.org/series/18592/
State : failure

== Summary ==

Thank you for submitting this patch series to OpenEmbedded Core. This is an automated response. Several tests have been executed on the proposed series by patchtest resulting in the following failures:

* Patch            [2/3] gnupg: upgrade 2.2.16 -> 2.2.17
 Issue             Missing or incorrectly formatted CVE tag in included patch file [test_cve_tag_format] 
  Suggested fix    Correct or include the CVE tag on cve patch with format: "CVE: CVE-YYYY-XXXX"

If you believe any of these test results are incorrect, please reply to the mailing list ([email protected]) raising your concerns. Otherwise we would appreciate you correcting the issues and submitting a new version of the patchset if applicable. Please ensure you add/increment the version number when sending the new version (i.e. [PATCH] -> [PATCH v2] -> [PATCH v3] -> ...).

---

Guidelines:     https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite:     http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe