curl: upgrade 7.65.1 -> 7.65.2

PATCH Superseded Anuj Mittal 1 participant 7 messages Jul 18, 2019

lore

Share & tools

lore

Anuj Mittal

author

2019-07-18 02:16 UTC #0 lore raw

PATCH 1/6 curl: upgrade 7.65.1 -> 7.65.2

Changelog:
https://curl.haxx.se/changes.html#7_65_2

Signed-off-by Anuj Mittal <[email protected]>

---
 ...format-security-fixes-in-libipt_icmp.patch | 61 -------------------
 .../curl/{curl_7.65.1.bb => curl_7.65.2.bb}   |  4 +-
 2 files changed, 2 insertions(+), 63 deletions(-)
 delete mode 100644 meta/recipes-extended/iptables/iptables/0003-extensions-format-security-fixes-in-libipt_icmp.patch
 rename meta/recipes-support/curl/{curl_7.65.1.bb => curl_7.65.2.bb} (95%)

meta/recipes-extended/iptables/iptables/0003-extensions-format-security-fixes-in-libipt_icmp.patch deleted +0 ~~-61~~

deleted file mode 100644
index e26594d19b..0000000000
@@ -1,61 +0,0 @@
-From 907e429d7548157016cd51aba4adc5d0c7d9f816 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <[email protected]>
-Date: Wed, 14 Nov 2018 07:35:28 +0100
-Subject: extensions: format-security fixes in libip[6]t_icmp
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-introduced support for gcc feature to check format string against passed
-argument.  This commit adds missing bits to extenstions's libipt_icmp.c
-and libip6t_icmp6.c that were causing build to fail.
-
-Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-Signed-off-by: Adam Gołębiowski <[email protected]>
-Signed-off-by: Pablo Neira Ayuso <[email protected]>
-
-Upstream-Status: Backport
----
- extensions/libip6t_icmp6.c | 4 ++--
- extensions/libipt_icmp.c   | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
-index 45a71875..cc7bfaeb 100644
---- a/extensions/libip6t_icmp6.c
-+++ b/extensions/libip6t_icmp6.c
-@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 	type_name = icmp6_type_xlate(icmptype);
- 
- 	if (type_name) {
--		xt_xlate_add(xl, type_name);
-+		xt_xlate_add(xl, "%s", type_name);
- 	} else {
- 		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
- 			if (icmpv6_codes[i].type == icmptype &&
-@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 				break;
- 
- 		if (i != ARRAY_SIZE(icmpv6_codes))
--			xt_xlate_add(xl, icmpv6_codes[i].name);
-+			xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
- 		else
- 			return 0;
- 	}
-diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
-index 54189976..e76257c5 100644
---- a/extensions/libipt_icmp.c
-+++ b/extensions/libipt_icmp.c
-@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 			if (icmp_codes[i].type == icmptype &&
- 			    icmp_codes[i].code_min == code_min &&
- 			    icmp_codes[i].code_max == code_max) {
--				xt_xlate_add(xl, icmp_codes[i].name);
-+				xt_xlate_add(xl, "%s", icmp_codes[i].name);
- 				return 1;
- 			}
- 	}
--- 
-cgit v1.2.1
-

meta/recipes-support/curl/curl_7.65.2.bb renamed from meta/recipes-support/curl/curl_7.65.1.bb +2 -2

similarity index 95%
rename from meta/recipes-support/curl/curl_7.65.1.bb
rename to meta/recipes-support/curl/curl_7.65.2.bb
index e7bfe6cc0b..2fff04434a 100644
@@ -9,8 +9,8 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
            file://0001-replace-krb5-config-with-pkg-config.patch \
 "
 
-SRC_URI[md5sum] = "03ca3fa53ac4d791be66e30ba75b56ea"
-SRC_URI[sha256sum] = "cbd36df60c49e461011b4f3064cff1184bdc9969a55e9608bf5cadec4686e3f7"
+SRC_URI[md5sum] = "88910bdda3752a98083b6dbe85bafcaa"
+SRC_URI[sha256sum] = "8093398b51e7d8337dac6f8fa6f1f77d562bdd9eca679dff9d9c3b8160ebfd28"
 
 CVE_PRODUCT = "curl libcurl"
 inherit autotools pkgconfig binconfig multilib_header

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:16 UTC #1 lore raw

PATCH 2/6 binutils: CVE-2019-9070 is same as CVE-2019-9071

See:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=89395

Signed-off-by Anuj Mittal <[email protected]>

---
 meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch | 1 +
 1 file changed, 1 insertion(+)

meta/recipes-devtools/binutils/binutils/CVE-2019-9071.patch +1 -0

index 26f4809cf0..f02539942f 100644
@@ -16,6 +16,7 @@ Subject: [PATCH] Pull in patch for libiberty that fixes a stack exhaustion bug
 	reached.
 
 CVE: CVE-2019-9071
+CVE: CVE-2019-9070
 Upstream-Status: Backport
 Signed-off-by: Anuj Mittal <[email protected]>
 ---

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:16 UTC #2 lore raw

PATCH 3/6 qemu: fix CVE-2019-12155

In reply to Anuj Mittal

Signed-off-by Anuj Mittal <[email protected]>

---
 meta/recipes-devtools/qemu/qemu.inc           |  1 +
 .../qemu/qemu/CVE-2019-12155.patch            | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2019-12155.patch

meta/recipes-devtools/qemu/qemu.inc +1 -0

index dfe17eed8b..7f0b3a7a73 100644
@@ -24,6 +24,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
            file://0009-linux-user-Fix-webkitgtk-hangs-on-32-bit-x86-target.patch \
            file://0010-Revert-linux-user-fix-mmap-munmap-mprotect-mremap-sh.patch \
            file://0013-target-arm-Fix-vector-operation-segfault.patch \
+	   file://CVE-2019-12155.patch \
            "
 UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"

meta/recipes-devtools/qemu/qemu/CVE-2019-12155.patch new file +35 -0

new file mode 100644
index 0000000000..c49a5e9a2a
@@ -0,0 +1,35 @@
+From d52680fc932efb8a2f334cc6993e705ed1e31e99 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <[email protected]>
+Date: Thu, 25 Apr 2019 12:05:34 +0530
+Subject: [PATCH] qxl: check release info object
+
+When releasing spice resources in release_resource() routine,
+if release info object 'ext.info' is null, it leads to null
+pointer dereference. Add check to avoid it.
+
+Reported-by: Bugs SysSec <[email protected]>
+Signed-off-by: Prasad J Pandit <[email protected]>
+Message-id: [email protected]
+Signed-off-by: Gerd Hoffmann <[email protected]>
+
+Upstream-Status: Backport
+CVE: CVE-2019-12155
+Signed-off-by: Anuj Mittal <[email protected]>
+---
+ hw/display/qxl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/display/qxl.c b/hw/display/qxl.c
+index c8ce5781e03..632923add23 100644
+--- a/hw/display/qxl.c
++++ b/hw/display/qxl.c
+@@ -777,6 +777,9 @@ static void interface_release_resource(QXLInstance *sin,
+     QXLReleaseRing *ring;
+     uint64_t *item, id;
+ 
++    if (!ext.info) {
++        return;
++    }
+     if (ext.group_id == MEMSLOT_GROUP_HOST) {
+         /* host group -> vga mode update request */
+         QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id);

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:16 UTC #3 lore raw

PATCH 4/6 bzip2: upgrade 1.0.7 -> 1.0.8

In reply to Anuj Mittal

License-Update: Change in version and copyright year/date.

Changelog:
https://sourceware.org/git/?p=bzip2.git;a=blob;f=CHANGES

Signed-off-by Anuj Mittal <[email protected]>

---
 .../bzip2/{bzip2_1.0.7.bb => bzip2_1.0.8.bb}                | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-extended/bzip2/{bzip2_1.0.7.bb => bzip2_1.0.8.bb} (85%)

meta/recipes-extended/bzip2/bzip2_1.0.8.bb renamed from meta/recipes-extended/bzip2/bzip2_1.0.7.bb +3 -3

similarity index 85%
rename from meta/recipes-extended/bzip2/bzip2_1.0.7.bb
rename to meta/recipes-extended/bzip2/bzip2_1.0.8.bb
index 02e9d9ef07..73d933a002 100644
@@ -5,15 +5,15 @@ LZ77/LZ78-based compressors, and approaches the performance of the PPM family of
 HOMEPAGE = "https://sourceware.org/bzip2/"
 SECTION = "console/utils"
 LICENSE = "bzip2"
-LIC_FILES_CHKSUM = "file://LICENSE;beginline=4;endline=37;md5=39406315f540c69bd05b1531daedd2ae"
+LIC_FILES_CHKSUM = "file://LICENSE;beginline=4;endline=37;md5=600af43c50f1fcb82e32f19b32df4664"
 
 SRC_URI = "https://sourceware.org/pub/${BPN}/${BPN}-${PV}.tar.gz \
            file://configure.ac;subdir=${BP} \
            file://Makefile.am;subdir=${BP} \
            file://run-ptest \
            "
-SRC_URI[md5sum] = "1a6a61cc867be4f3d6549037a09bf13e"
-SRC_URI[sha256sum] = "e768a87c5b1a79511499beb41500bcc4caf203726fff46a6f5f9ad27fe08ab2b"
+SRC_URI[md5sum] = "67e051268d0c475ea773822f7500d0e5"
+SRC_URI[sha256sum] = "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269"
 
 UPSTREAM_CHECK_URI = "https://www.sourceware.org/pub/bzip2/"
 UPSTREAM_VERSION_UNKNOWN = "1"

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:16 UTC #4 lore raw

PATCH 5/6 glib-2.0: upgrade 2.60.4 -> 2.60.5

In reply to Anuj Mittal

Changes:
https://github.com/GNOME/glib/blob/glib-2-60/NEWS

Signed-off-by Anuj Mittal <[email protected]>

---
 meta/recipes-core/glib-2.0/glib-2.0/relocate-modules.patch    | 2 +-
 .../glib-2.0/{glib-2.0_2.60.4.bb => glib-2.0_2.60.5.bb}       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-core/glib-2.0/{glib-2.0_2.60.4.bb => glib-2.0_2.60.5.bb} (88%)

meta/recipes-core/glib-2.0/glib-2.0/relocate-modules.patch +1 -1

index 2d698a67c8..380bee086c 100644
@@ -1,4 +1,4 @@
-From 17ca85e329bf39c004b73a02e94b597dac41ddfe Mon Sep 17 00:00:00 2001
+From 9c5d6e6ce5254a5f050bba2118a4a1807292c02a Mon Sep 17 00:00:00 2001
 From: Ross Burton <[email protected]>
 Date: Fri, 11 Mar 2016 15:35:55 +0000
 Subject: [PATCH] glib-2.0: relocate the GIO module directory for native builds

meta/recipes-core/glib-2.0/glib-2.0_2.60.5.bb renamed from meta/recipes-core/glib-2.0/glib-2.0_2.60.4.bb +2 -2

similarity index 88%
rename from meta/recipes-core/glib-2.0/glib-2.0_2.60.4.bb
rename to meta/recipes-core/glib-2.0/glib-2.0_2.60.5.bb
index f7280090bb..bcb1fdb9a6 100644
@@ -21,5 +21,5 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
 SRC_URI_append_class-native = " file://relocate-modules.patch"
 SRC_URI_append_class-target = " file://glib-meson.cross"
 
-SRC_URI[md5sum] = "87e2c4973470811dfed3d6746c961488"
-SRC_URI[sha256sum] = "2b941ec5dcb92e5ea83fe42f9eb55a827bc8a12c153ad2489d551c31d04733dd"
+SRC_URI[md5sum] = "7dced27cfa79419dc6cc82c02190c457"
+SRC_URI[sha256sum] = "3edf1df576ee82b2ecb8ba85c343644e48ee62e68290e71e6084b00d6ba2622e"

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:16 UTC #5 lore raw

PATCH 6/6 vte: upgrade 0.56.1 -> 0.56.3

In reply to Anuj Mittal

Signed-off-by Anuj Mittal <[email protected]>

---
 meta/recipes-support/vte/{vte_0.56.1.bb => vte_0.56.3.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-support/vte/{vte_0.56.1.bb => vte_0.56.3.bb} (93%)

meta/recipes-support/vte/vte_0.56.3.bb renamed from meta/recipes-support/vte/vte_0.56.1.bb +2 -2

similarity index 93%
rename from meta/recipes-support/vte/vte_0.56.1.bb
rename to meta/recipes-support/vte/vte_0.56.3.bb
index 702436b368..0deee175df 100644
@@ -19,8 +19,8 @@ SRC_URI += "file://0001-Don-t-enable-stack-protection-by-default.patch \
            file://0001-app.cc-use-old-school-asignment-to-avoid-gcc-4.8-err.patch \
            file://0001-Add-W_EXITCODE-macro-for-non-glibc-systems.patch \
            "
-SRC_URI[archive.md5sum] = "a8984cd5a101dbff0b0c875d1de3f692"
-SRC_URI[archive.sha256sum] = "02fa8ecc02a9332e47f486795494527b5687b3bd448e73e6b67285f2f326dc7c"
+SRC_URI[archive.md5sum] = "adf341807861a5dad9f98e5c701c0769"
+SRC_URI[archive.sha256sum] = "17a1d4bc8848f1d2acfa4c20aaa24b9bac49f057b8909c56d3dafec2e2332648"
 
 ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"

Signature · 1 line

2.20.1

Anuj Mittal

author

2019-07-18 02:21 UTC #6 lore raw

PATCH v2 1/1 curl: upgrade 7.65.1 -> 7.65.2

In reply to Anuj Mittal

Changelog:
https://curl.haxx.se/changes.html#7_65_2

Signed-off-by Anuj Mittal <[email protected]>

---
 meta/recipes-support/curl/{curl_7.65.1.bb => curl_7.65.2.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-support/curl/{curl_7.65.1.bb => curl_7.65.2.bb} (95%)

meta/recipes-support/curl/curl_7.65.2.bb renamed from meta/recipes-support/curl/curl_7.65.1.bb +2 -2

similarity index 95%
rename from meta/recipes-support/curl/curl_7.65.1.bb
rename to meta/recipes-support/curl/curl_7.65.2.bb
index e7bfe6cc0b..2fff04434a 100644
@@ -9,8 +9,8 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
            file://0001-replace-krb5-config-with-pkg-config.patch \
 "
 
-SRC_URI[md5sum] = "03ca3fa53ac4d791be66e30ba75b56ea"
-SRC_URI[sha256sum] = "cbd36df60c49e461011b4f3064cff1184bdc9969a55e9608bf5cadec4686e3f7"
+SRC_URI[md5sum] = "88910bdda3752a98083b6dbe85bafcaa"
+SRC_URI[sha256sum] = "8093398b51e7d8337dac6f8fa6f1f77d562bdd9eca679dff9d9c3b8160ebfd28"
 
 CVE_PRODUCT = "curl libcurl"
 inherit autotools pkgconfig binconfig multilib_header

Signature · 1 line

2.20.1