diff options
Diffstat (limited to 'user')
43 files changed, 797 insertions, 263 deletions
diff --git a/user/alkimia/APKBUILD b/user/alkimia/APKBUILD index 685cfa1cb..0b3f062eb 100644 --- a/user/alkimia/APKBUILD +++ b/user/alkimia/APKBUILD @@ -1,7 +1,7 @@ # Contributor: A. Wilcox <awilfox@adelielinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=alkimia -pkgver=8.0.3 +pkgver=8.0.4 pkgrel=0 pkgdesc="Library for common financial functionality" url="https://community.kde.org/Alkimia/libalkimia" @@ -11,8 +11,8 @@ license="LGPL-2.1+" depends="" depends_dev="gmp-dev qt5-qtbase-dev" makedepends="$depends_dev cmake extra-cmake-modules qt5-qtwebkit-dev - kconfig-dev kcoreaddons-dev kdelibs4support-dev knewstuff-dev - kpackage-dev plasma-framework-dev" + kconfig-dev kcoreaddons-dev kdelibs4support-dev knewstuff-dev + kpackage-dev plasma-framework-dev" subpackages="$pkgname-dev $pkgname-lang" source="https://download.kde.org/stable/alkimia/$pkgver/alkimia-$pkgver.tar.xz" @@ -39,4 +39,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="04debd3adeba6380ffe7e9d3949e927dca12ecd7f83dea7b7ba6295b158272c636978c89800757166889e632fed09f3e8b3ce19adc9b91e3369e3b16a5b6cb1e alkimia-8.0.3.tar.xz" +sha512sums="49b771ac28ec76143cf1237a21a834fa38689c91c773a472cc090e94f49287a79ad7790ef068cd6bebc4e64aa97e5026a9ea5be841bbdb3ca89b00b6ca7acc27 alkimia-8.0.4.tar.xz" diff --git a/user/at-spi2-atk/APKBUILD b/user/at-spi2-atk/APKBUILD index b64c2e0f2..85a16db16 100644 --- a/user/at-spi2-atk/APKBUILD +++ b/user/at-spi2-atk/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Natanael Copa <ncopa@alpinelinux.org> # Maintainer: pkgname=at-spi2-atk -pkgver=2.34.2 +pkgver=2.38.0 pkgrel=0 pkgdesc="GTK+ module to bridge ATK to D-Bus at-spi" url="https://wiki.linuxfoundation.org/accessibility/d-bus" @@ -28,4 +28,4 @@ package() { DESTDIR="$pkgdir" ninja -C build install } -sha512sums="59e7ad5c944748ca00af8b0a9df03c9ffbc6afae6e65c25a2566a9e2a30e66724c4492076be1730c2894c636f82c795c533669572584d8d5675f68b349ad16c4 at-spi2-atk-2.34.2.tar.xz" +sha512sums="2f40ecbc55b0fbaa57ade952a75583bc8fbfde234cce9248489e9ae06e0597d98c2f4c77d8279758dec29da97e06cde5708d30a1238d91bebd023b2320f38528 at-spi2-atk-2.38.0.tar.xz" diff --git a/user/at-spi2-core/APKBUILD b/user/at-spi2-core/APKBUILD index 5788deb50..66b2ebcac 100644 --- a/user/at-spi2-core/APKBUILD +++ b/user/at-spi2-core/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Natanael Copa <ncopa@alpinelinux.org> # Maintainer: pkgname=at-spi2-core -pkgver=2.36.0 +pkgver=2.38.0 pkgrel=0 pkgdesc="Protocol definitions and daemon for D-Bus at-spi" url="https://wiki.linuxfoundation.org/accessibility/d-bus" @@ -26,4 +26,4 @@ package() { DESTDIR="$pkgdir" ninja -C builddir/ install } -sha512sums="f45d7e68bfcd9b93cebc47e30febce1ae6a4d9df2fbc9d5bdc25babb123c922d0f9a229485770b2f6ed386178144c20486fa3e46195041ea65a54ab019b1cbb6 at-spi2-core-2.36.0.tar.xz" +sha512sums="3a1eb27cff6e0dd03119b4f8361a3b6037b26c511e80e2d003d1d5c41fede6d49eb5e0ac1ee45cfb4f3ca8e53292a7e2da67df80be28e77014775e41777a96c1 at-spi2-core-2.38.0.tar.xz" diff --git a/user/bind/APKBUILD b/user/bind/APKBUILD index 2b39c5f1f..44cd5cf30 100644 --- a/user/bind/APKBUILD +++ b/user/bind/APKBUILD @@ -9,7 +9,7 @@ _p=${pkgver#*_p} _ver=${pkgver%_p*} _major=${pkgver%%.*} [ "$_p" != "$pkgver" ] && _ver="${_ver}-P$_p" -pkgrel=0 +pkgrel=1 pkgdesc="The ISC DNS server" url="https://www.isc.org/downloads/bind/" arch="all" diff --git a/user/bluez/APKBUILD b/user/bluez/APKBUILD index 6f90834b1..3d7c3736a 100644 --- a/user/bluez/APKBUILD +++ b/user/bluez/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=bluez -pkgver=5.54 -pkgrel=1 +pkgver=5.55 +pkgrel=0 pkgdesc="Linux Bluetooth protocol stack" url="http://www.bluez.org/" arch="all" @@ -10,8 +10,8 @@ depends="dbus elogind" makedepends="alsa-lib-dev dbus-dev eudev-dev glib-dev libical-dev linux-headers ncurses-dev" subpackages="$pkgname-dev $pkgname-doc $pkgname-libs $pkgname-bccmd - $pkgname-btmon $pkgname-cups $pkgname-deprecated $pkgname-hid2hci - $pkgname-obexd $pkgname-openrc $pkgname-tools" + $pkgname-btmgmt $pkgname-btmon $pkgname-cups $pkgname-deprecated + $pkgname-hid2hci $pkgname-obexd $pkgname-openrc $pkgname-tools" source="https://www.kernel.org/pub/linux/bluetooth/bluez-$pkgver.tar.xz https://ftp.gnu.org/gnu/readline/readline-8.0.tar.gz bluetooth.initd @@ -30,6 +30,8 @@ source="https://www.kernel.org/pub/linux/bluetooth/bluez-$pkgver.tar.xz " # secfixes: +# 5.55-r0: +# - CVE-2020-27153 # 5.54-r0: # - CVE-2020-0556 @@ -61,7 +63,8 @@ build() { --enable-library \ --enable-deprecated \ --enable-experimental \ - --enable-tools + --enable-tools \ + --enable-hid2hci make } @@ -91,6 +94,12 @@ btmon() { mv "$pkgdir"/usr/bin/btmon "$subpkgdir"/usr/bin/ } +btmgmt() { + pkgdesc="Bluez tool for the Bluetooth Management API" + install -Dm755 "$builddir"/tools/btmgmt -t \ + "$subpkgdir"/usr/bin +} + cups() { pkgdesc="BlueZ backend for CUPS" depends="cups" @@ -132,7 +141,7 @@ tools() { done } -sha512sums="e19d15d3a478a7af47c1921c8827843492e38787b1182152155bd3d8ad9e1d8ee25c5fda1f24e38c54ebbf946b09fe75007dca9a24d1c35f73303558e558dcbe bluez-5.54.tar.xz +sha512sums="9423cb60d15a6f068838497a1eaea9f5a32d70c07191c313ba821a6919d6e0c436ada4f547cc5f2db5eacc0123429ad54851f57df2554f61fa293743ec14a033 bluez-5.55.tar.xz 41759d27bc3a258fefd7f4ff3277fa6ab9c21abb7b160e1a75aa8eba547bd90b288514e76264bd94fb0172da8a4faa54aab2c07b68a0356918ecf7f1969e866f readline-8.0.tar.gz fc43c78ed248ea412529eed5ae8bb47bacca9bf5b3b10de121ddd4e792c85893561a88be4aa2c6318106e5d2146a721445152d44fa60ca257ca0b4eb87318c1e bluetooth.initd 8d7b7c8938a2316ce0a855e9bdf1ef8fcdf33d23f4011df828270a088b88b140a19c432e83fef15355d0829e3c86be05b63e7718fef88563254ea239b8dc12ac rfcomm.initd diff --git a/user/btrfs-progs/APKBUILD b/user/btrfs-progs/APKBUILD index e8412ef96..c2c423ff8 100644 --- a/user/btrfs-progs/APKBUILD +++ b/user/btrfs-progs/APKBUILD @@ -1,7 +1,7 @@ # Contributor: A. Wilcox <awilfox@adelielinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=btrfs-progs -pkgver=5.7 +pkgver=5.9 pkgrel=0 pkgdesc="File system utilities for Btrfs" url="https://btrfs.wiki.kernel.org/index.php/Main_Page" @@ -31,4 +31,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="72c3af13ca589f2e0b96cb7602319035ef8aab6ee224fff3544a5d0bfc013a66552dde4533ec5e64696d404b8905431cd0f25367c40fd34ea39be7c0ed8c2d16 btrfs-progs-v5.7.tar.xz" +sha512sums="38db047198ab0467d3fe235f7e8e1fd14ade00dd0b182588220c5f5e4b598efbdcd30a3d5d56cf0a0ed8a902d2374af0927eb7f3720cd761172c7291a2a65c94 btrfs-progs-v5.9.tar.xz" diff --git a/user/cifs-utils/APKBUILD b/user/cifs-utils/APKBUILD index 798bb8a1e..17b83ab41 100644 --- a/user/cifs-utils/APKBUILD +++ b/user/cifs-utils/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Francesco Colista <fcolista@alpinelinux.org> # Maintainer: Max Rees <maxcrees@me.com> pkgname=cifs-utils -pkgver=6.10 +pkgver=6.11 pkgrel=0 pkgdesc="CIFS filesystem user-space tools" url="https://wiki.samba.org/index.php/LinuxCIFS_utils" @@ -18,6 +18,10 @@ source="https://ftp.samba.org/pub/linux-cifs/$pkgname/$pkgname-$pkgver.tar.bz2 xattr_size_max.patch " +# secfixes: +# 6.11-r0: +# - CVE-2020-14342 + prepare() { default_prepare autoreconf -vif @@ -48,7 +52,7 @@ package() { chmod u+s "$pkgdir"/sbin/mount.cifs } -sha512sums="e19ca69b7948f01c1fd6a4ed069e00511588b903a5b8b0dc35ac1e00743170b9ca180b747c47d56cfacf273b296da21df60e1957404f26ebf2ba80bfa7e275cc cifs-utils-6.10.tar.bz2 +sha512sums="064c0ac75572fb44908390508462e4fdfe0686751149fd8b656a209dd961a5a24a7d9774c38c0e72fa5f9875b43aea7bf2de038c4e4a63a11664e71d9003100e cifs-utils-6.11.tar.bz2 99a2fab05bc2f14a600f89526ae0ed2c183cfa179fe386cb327075f710aee3aed5ae823f7c2f51913d1217c2371990d6d4609fdb8d80288bd3a6139df3c8aebe musl-fix-includes.patch f3acb4f7873628d67c7dfb2378135c302fe382e314277829ea5569710bac0ddb43684aa6d143327d735aec641997084eaa567823b534138ed884bd74044b652a respect-destdir.patch 2a9366ec1ddb0389c535d2fa889f63287cb8374535a47232de102c7e50b6874f67a3d5ef3318df23733300fd8459c7ec4b11f3211508aca7800b756119308e98 xattr_size_max.patch" diff --git a/user/claws-mail/APKBUILD b/user/claws-mail/APKBUILD index 72256b3a5..1554a00da 100644 --- a/user/claws-mail/APKBUILD +++ b/user/claws-mail/APKBUILD @@ -1,7 +1,7 @@ # Contributor: A. Wilcox <awilfox@adelielinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=claws-mail -pkgver=3.17.6 +pkgver=3.17.8 pkgrel=0 pkgdesc="User-friendly, lightweight, and fast email client" url="https://www.claws-mail.org/" @@ -15,6 +15,10 @@ makedepends="compface-dev curl-dev dbus-glib-dev enchant-dev gnutls-dev subpackages="$pkgname-doc $pkgname-lang" source="https://www.claws-mail.org/download.php?file=releases/claws-mail-$pkgver.tar.xz" +# secfixes: +# 3.17.8-r0: +# - CVE-2020-16094 + build() { ./configure \ --build=$CBUILD \ @@ -36,4 +40,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="07fdf7fce722ee1e50aa155bca720323a58842b372d8295bed33c7245fce5790a1bd3ed7462130664a218a804ab6bd1ba3663ee3e53fbbac6a4a477dd676ede0 claws-mail-3.17.6.tar.xz" +sha512sums="dc29c968dc81a184af8f66c1afe5c9d17558ce6a4a8b196136a9fb5deec96aa67eec42148ed0f4d6d6ee94aec2791247b9034090dac81beec193bd7d366617d7 claws-mail-3.17.8.tar.xz" diff --git a/user/confuse/APKBUILD b/user/confuse/APKBUILD index 4bdfa851f..fc31d73d1 100644 --- a/user/confuse/APKBUILD +++ b/user/confuse/APKBUILD @@ -1,10 +1,10 @@ # Contributor: Mira Ressel <aranea@aixah.de> # Maintainer: pkgname=confuse -pkgver=3.2.2 +pkgver=3.3 pkgrel=0 pkgdesc="Small configuration file parser library for C" -url=" " +url="https://github.com/martinh/libconfuse" arch="all" license="ISC" depends="" @@ -12,6 +12,10 @@ makedepends="" subpackages="$pkgname-dev $pkgname-doc $pkgname-lang" source="https://github.com/martinh/libconfuse/releases/download/v$pkgver/$pkgname-$pkgver.tar.xz" +# secfixes: +# 3.3-r0: +# - CVE-2018-19760 + build() { ./configure \ --build=$CBUILD \ @@ -34,4 +38,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="c6baea65e064fe7f2d1bde187c6dcbb7f03c31f5d777cb04576f9cc2d94e9c96b7ee202e030e9a2c7eb619deb240d9e76fb12b3528ae5aa0d3abe231354d12c9 confuse-3.2.2.tar.xz" +sha512sums="93cc62d98166199315f65a2f6f540a9c0d33592b69a2c6a57fd17f132aecc6ece39b9813b96c9a49ae2b66a99b7eba1188a9ce9e360e1c5fb4b973619e7088a0 confuse-3.3.tar.xz" diff --git a/user/eigen/APKBUILD b/user/eigen/APKBUILD index 125cf77fe..aa2a537d2 100644 --- a/user/eigen/APKBUILD +++ b/user/eigen/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Bradley J Chambers <brad.chambers@gmail.com> # Maintainer: pkgname=eigen -pkgver=3.3.7 +pkgver=3.3.8 pkgrel=0 pkgdesc="Eigen is a C++ template library for linear algebra" url="http://eigen.tuxfamily.org/index.php?title=Main_Page" @@ -11,12 +11,7 @@ license="MPL-2.0" depends="" makedepends="" subpackages="$pkgname-dev" -source="$pkgname-$pkgver.tar.gz::http://bitbucket.org/eigen/$pkgname/get/$pkgver.tar.gz" - -prepare() { - mv "$srcdir"/eigen-eigen-* "$builddir" # directory name contains hash - default_prepare -} +source="https://gitlab.com/libeigen/eigen/-/archive/$pkgver/eigen-$pkgver.tar.gz" package() { mkdir -p "$pkgdir"/usr/include/eigen3 @@ -24,4 +19,4 @@ package() { cp -r "$builddir"/unsupported "$pkgdir"/usr/include/eigen3 } -sha512sums="34cf600914cce719d61511577ef9cd26fbdcb7a6fad1d0ab8396f98b887fac6a5577d3967e84a8f56225cc50de38f3b91f34f447d14312028383e32b34ea1972 eigen-3.3.7.tar.gz" +sha512sums="5b4b5985b0294e07b3ed1155720cbbfea322fe9ccad0fc8b0a10060b136a9169a15d5b9cb7a434470cadd45dff0a43049edc20d2e1070005481a120212edc355 eigen-3.3.8.tar.gz" diff --git a/user/f2fs-tools/APKBUILD b/user/f2fs-tools/APKBUILD index 7784c170d..59246c22e 100644 --- a/user/f2fs-tools/APKBUILD +++ b/user/f2fs-tools/APKBUILD @@ -1,7 +1,7 @@ # Contributor: CyberLeo <cyberleo@cyberleo.net> # Maintainer: CyberLeo <cyberleo@cyberleo.net> pkgname=f2fs-tools -pkgver=1.13.0 +pkgver=1.14.0 pkgrel=0 pkgdesc="Tools for the Flash-Friendly File System (F2FS)" url="https://git.kernel.org/cgit/linux/kernel/git/jaegeuk/f2fs-tools.git" @@ -13,6 +13,14 @@ makedepends="automake autoconf bsd-compat-headers libtool util-linux-dev linux-h subpackages="$pkgname-doc $pkgname-dev $pkgname-libs" source="https://git.kernel.org/cgit/linux/kernel/git/jaegeuk/f2fs-tools.git/snapshot/$pkgname-$pkgver.tar.gz" +#secfixes: +# 1.14.0-r0: +# - CVE-2020-6104 +# - CVE-2020-6105 +# - CVE-2020-6106 +# - CVE-2020-6107 +# - CVE-2020-6108 + prepare() { default_prepare ./autogen.sh @@ -31,4 +39,4 @@ package() { install -D -m644 mkfs/f2fs_format_utils.h "$pkgdir"/usr/include/ } -sha512sums="fd920a19e8705a65395809aeef55791c5678ed31c026cdf41fc173e0dbcacdef1db7e0e184ec1aae8637b1784e2ad6e0207583e918255483fe43c73f89bd7f7f f2fs-tools-1.13.0.tar.gz" +sha512sums="951b74178f99722550e73f331be066f124f6ee6022710f6b47ae47390b978b08f12a7f2a268d82ca69a32bf440cd3ce3adddc8a4c49c32df83da87e7f659f98d f2fs-tools-1.14.0.tar.gz" diff --git a/user/freetype/APKBUILD b/user/freetype/APKBUILD index 78c8d96ae..88f531f10 100644 --- a/user/freetype/APKBUILD +++ b/user/freetype/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Carlo Landmeter <clandmeter@gmail.com> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=freetype -pkgver=2.10.2 +pkgver=2.10.4 pkgrel=0 pkgdesc="TrueType font rendering library" url="https://www.freetype.org/" @@ -14,6 +14,8 @@ subpackages="$pkgname-dev $pkgname-doc" source="http://download.savannah.gnu.org/releases/freetype/freetype-$pkgver.tar.xz" # secfixes: +# 2.10.4-r0: +# - CVE-2020-15999 # 2.9.1-r0: # - CVE-2018-6942 # 2.7.1-r1: @@ -37,4 +39,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="cf45089bd8893d7de2cdcb59d91bbb300e13dd0f0a9ef80ed697464ba7aeaf46a5a81b82b59638e6b21691754d8f300f23e1f0d11683604541d77f0f581affaa freetype-2.10.2.tar.xz" +sha512sums="827cda734aa6b537a8bcb247549b72bc1e082a5b32ab8d3cccb7cc26d5f6ee087c19ce34544fa388a1eb4ecaf97600dbabc3e10e950f2ba692617fee7081518f freetype-2.10.4.tar.xz" diff --git a/user/gsettings-desktop-schemas/APKBUILD b/user/gsettings-desktop-schemas/APKBUILD index 46fd83a7e..3388b82d1 100644 --- a/user/gsettings-desktop-schemas/APKBUILD +++ b/user/gsettings-desktop-schemas/APKBUILD @@ -1,6 +1,6 @@ # Maintainer: pkgname=gsettings-desktop-schemas -pkgver=3.36.1 +pkgver=3.38.0 pkgrel=0 pkgdesc="GSettings schemas shared by GNOME desktop components" url="https://developer.gnome.org/gio/unstable/GSettings.html" @@ -14,6 +14,8 @@ source="https://download.gnome.org/sources/$pkgname/${pkgver%.*}/$pkgname-$pkgve prepare() { default_prepare sed -i -r 's:"(/system):"/org/gnome\1:g' schemas/*.in + # Correct pkgconfig install path + sed -i "/install_dir/s,datadir,libdir," meson.build } build() { @@ -29,12 +31,4 @@ package() { DESTDIR="$pkgdir" ninja -C build install } -dev() { - default_dev - depends="$pkgname" - mkdir -p "$subpkgdir"/usr/lib - mv "$pkgdir"/usr/share/pkgconfig "$subpkgdir"/usr/lib -} - - -sha512sums="623a3759fe84cc5ea897043cc7c337a4f83302ebe5cfb9d214210a48e460e22b180518f5d768382ec18396bb2e86f22649dbc9b367a858e56b1ee8d2cab58fa8 gsettings-desktop-schemas-3.36.1.tar.xz" +sha512sums="5af7da90b8e7eec1c98e9e44653955f2882961dd9b5e2bf00e4eeb9f4f1149ae5171c600d457c6ab9c7482471c1a0e98f92f645a7ee7298e1b843c608f660756 gsettings-desktop-schemas-3.38.0.tar.xz" diff --git a/user/horizon/APKBUILD b/user/horizon/APKBUILD index b49640561..8d2e480c2 100644 --- a/user/horizon/APKBUILD +++ b/user/horizon/APKBUILD @@ -1,8 +1,8 @@ # Contributor: A. Wilcox <awilfox@adelielinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=horizon -pkgver=0.9.5 -pkgrel=1 +pkgver=0.9.6 +pkgrel=0 pkgdesc="Installation tools for Adélie Linux" url="https://horizon.adelielinux.org/" arch="all" @@ -17,9 +17,7 @@ makedepends="bcnm-dev boost-dev cmake curl-dev eudev-dev libarchive-dev libcap-dev libx11-dev libxkbfile-dev qt5-qtbase-dev" subpackages="$pkgname-image $pkgname-dbg $pkgname-dev $pkgname-doc $pkgname-qt5 $pkgname-tools $pkgname-wizard $pkgname-boot" -source="https://distfiles.adelielinux.org/source/horizon-$pkgver.tar.xz - bootloader.patch - " +source="https://distfiles.adelielinux.org/source/horizon-$pkgver.tar.xz" build() { if [ "$CBUILD" != "$CHOST" ]; then @@ -158,5 +156,4 @@ GLOBALS "$subpkgdir"/usr/share/xsessions/horizon.desktop } -sha512sums="373cbf87aa468d0ea41abad07f61cdaa6088cfdcba13c0beff245dbd8e270aa42c3e301a22913299d148e829114bd0b5aa746541c4b4b0c7286da35015c54d88 horizon-0.9.5.tar.xz -88e7c6df4dc2c8c7f6befd5f96f82267fefccb98d0c5e6c26c611323e505f7ee964dcfd2128dbe165c064d953e7afef2787ab49a6c4a834ffe8fd50c00eb26ae bootloader.patch" +sha512sums="d5ffe9bd423e98272ca780c59e6e32c42b284c68f3a0bace07bd693d457e2edcd68d7fc03f638b545960154ea26b7c09feee083dbffa986da2a7cd418be9500f horizon-0.9.6.tar.xz" diff --git a/user/horizon/bootloader.patch b/user/horizon/bootloader.patch deleted file mode 100644 index a09b4a603..000000000 --- a/user/horizon/bootloader.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 3658104dcc622e69a64cf97fbc9ed477f3faed6c Mon Sep 17 00:00:00 2001 -From: "A. Wilcox" <AWilcox@Wilcox-Tech.com> -Date: Wed, 30 Sep 2020 19:19:59 -0500 -Subject: [PATCH] meta: Run update-boot when bootloader requested -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If the user chooses no-boot or isn't installing Adélie, this will fail -quietly. But if the user is installing Adélie, this is necessary to -generate bootloader configuration. ---- - hscript/meta.cc | 26 ++++++++++++++++++++------ - 1 file changed, 20 insertions(+), 6 deletions(-) - -diff --git a/hscript/meta.cc b/hscript/meta.cc -index 4efdc80..84e851a 100644 ---- a/hscript/meta.cc -+++ b/hscript/meta.cc -@@ -823,7 +823,7 @@ bool Bootloader::execute() const { - << std::endl - << "chroot " << script->targetDirectory() - << " grub-install " << _device << std::endl; -- return true; -+ goto updateboot; - } - #ifdef HAS_INSTALL_ENV - if(run_command("/sbin/apk", -@@ -851,8 +851,8 @@ bool Bootloader::execute() const { - mount(nullptr, efipath.c_str(), nullptr, - MS_REMOUNT | MS_BIND | MS_RDONLY | MS_NOEXEC | MS_NODEV | - MS_NOSUID | MS_RELATIME, nullptr); -+ goto updateboot; - #endif /* HAS_INSTALL_ENV */ -- return true; /* LCOV_EXCL_LINE */ - } - else if(method == "grub-bios") { - if(script->options().test(Simulate)) { -@@ -861,7 +861,7 @@ bool Bootloader::execute() const { - << std::endl - << "chroot " << script->targetDirectory() - << " grub-install " << _device << std::endl; -- return true; -+ goto updateboot; - } - #ifdef HAS_INSTALL_ENV - if(run_command("/sbin/apk", -@@ -876,8 +876,8 @@ bool Bootloader::execute() const { - output_error(pos, "bootloader: failed to install GRUB"); - return false; - } -+ goto updateboot; - #endif /* HAS_INSTALL_ENV */ -- return true; /* LCOV_EXCL_LINE */ - } - else if(method == "iquik") { - output_error(pos, "bootloader: iQUIK is not yet supported"); -@@ -891,7 +891,7 @@ bool Bootloader::execute() const { - << "chroot " << script->targetDirectory() - << " grub-install --macppc-directory=/boot/grub " - << _device << std::endl; -- return true; -+ goto updateboot; - } - #ifdef HAS_INSTALL_ENV - if(run_command("/sbin/apk", -@@ -907,9 +907,23 @@ bool Bootloader::execute() const { - output_error(pos, "bootloader: failed to install GRUB"); - return false; - } -+ goto updateboot; - #endif /* HAS_INSTALL_ENV */ -- return true; /* LCOV_EXCL_LINE */ - } - - return false; /* LCOV_EXCL_LINE */ -+ -+updateboot: -+ /* We ignore if update-boot fails, in case the user has chosen no-boot. */ -+ if(script->options().test(Simulate)) { -+ std::cout << "chroot " << script->targetDirectory() -+ << " /usr/sbin/update-boot || true" << std::endl; -+ } -+#ifdef HAS_INSTALL_ENV -+ else { -+ run_command("chroot", -+ {script->targetDirectory(), "/usr/sbin/update-boot"}); -+ } -+#endif /* HAS_INSTALL_ENV */ -+ return true; - } --- -2.25.4 - diff --git a/user/i3status/APKBUILD b/user/i3status/APKBUILD index 01e567cee..f143b6fc5 100644 --- a/user/i3status/APKBUILD +++ b/user/i3status/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: pkgname=i3status pkgver=2.13 -pkgrel=1 +pkgrel=2 pkgdesc="Status bar generator for dzen2, xmobar or similar" url="https://i3wm.org/i3status/" arch="all" diff --git a/user/kdenlive/APKBUILD b/user/kdenlive/APKBUILD index 5df4dd36d..fb0c11c6b 100644 --- a/user/kdenlive/APKBUILD +++ b/user/kdenlive/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=kdenlive pkgver=20.08.1 -pkgrel=0 +pkgrel=1 pkgdesc="Libre video editor" url="https://kdenlive.org/" arch="all" diff --git a/user/libcroco/APKBUILD b/user/libcroco/APKBUILD index 209720aaa..4470ac952 100644 --- a/user/libcroco/APKBUILD +++ b/user/libcroco/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: pkgname=libcroco pkgver=0.6.13 -pkgrel=0 +pkgrel=1 pkgdesc="GNOME CSS 2 parsing and manipulation toolkit" url="https://gitlab.gnome.org/GNOME/libcroco" arch="all" @@ -11,11 +11,15 @@ subpackages="$pkgname-dev" depends="" makedepends="glib-dev libxml2-dev" checkdepends="cmd:which" -source="https://download.gnome.org/sources/$pkgname/0.6/$pkgname-$pkgver.tar.xz" +source="https://download.gnome.org/sources/$pkgname/0.6/$pkgname-$pkgver.tar.xz + CVE-2020-12825.patch + " # secfixes: # 0.6.12-r2: # - CVE-2017-7960 +# 0.6.13-r1: +# - CVE-2020-12825 build() { ./configure \ @@ -34,4 +38,5 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="038a3ac9d160a8cf86a8a88c34367e154ef26ede289c93349332b7bc449a5199b51ea3611cebf3a2416ae23b9e45ecf8f9c6b24ea6d16a5519b796d3c7e272d4 libcroco-0.6.13.tar.xz" +sha512sums="038a3ac9d160a8cf86a8a88c34367e154ef26ede289c93349332b7bc449a5199b51ea3611cebf3a2416ae23b9e45ecf8f9c6b24ea6d16a5519b796d3c7e272d4 libcroco-0.6.13.tar.xz +ae568a259a2a3a90f6cf107b4f0d5a0dbb6cb3a560262a43b96460457a4b72b7c5f45c2df9c061ed1f94c41b71bdcf69bd55582a77bf858e46c2c3c8a55fe6e3 CVE-2020-12825.patch" diff --git a/user/libcroco/CVE-2020-12825.patch b/user/libcroco/CVE-2020-12825.patch new file mode 100644 index 000000000..6fa66f659 --- /dev/null +++ b/user/libcroco/CVE-2020-12825.patch @@ -0,0 +1,187 @@ +From 44cbd1e718d6a08e59b9300280c340218a84e089 Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro <mcatanzaro@gnome.org> +Date: Wed, 12 Aug 2020 13:54:15 -0500 +Subject: [PATCH] libcroco: Limit recursion in block and any productions + (CVE-2020-12825) + +If we don't have any limits, we can recurse forever and overflow the +stack. + +This is per https://gitlab.gnome.org/Archive/libcroco/-/issues/8 + +https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404 +--- + src/cr-parser.c | 44 ++++++++++++++++++++++++++-------------- + 1 file changed, 29 insertions(+), 15 deletions(-) + +diff --git a/src/cr-parser.c b/src/st/croco/cr-parser.c +index 07f4ed9e8b..8304b75614 100644 +--- a/src/cr-parser.c ++++ b/src/cr-parser.c +@@ -136,6 +136,8 @@ struct _CRParserPriv { + + #define CHARS_TAB_SIZE 12 + ++#define RECURSIVE_CALLERS_LIMIT 100 ++ + /** + * IS_NUM: + *@a_char: the char to test. +@@ -343,9 +345,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this); + + static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this); + +-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this); ++static enum CRStatus cr_parser_parse_any_core (CRParser * a_this, ++ guint n_calls); + +-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this); ++static enum CRStatus cr_parser_parse_block_core (CRParser * a_this, ++ guint n_calls); + + static enum CRStatus cr_parser_parse_value_core (CRParser * a_this); + +@@ -783,7 +787,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) + cr_parser_try_to_skip_spaces_and_comments (a_this); + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + } while (status == CR_OK); + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, +@@ -794,7 +798,7 @@ cr_parser_parse_atrule_core (CRParser * a_this) + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, 0); + CHECK_PARSING_STATUS (status, + FALSE); + goto done; +@@ -929,11 +933,11 @@ cr_parser_parse_selector_core (CRParser * a_this) + + RECORD_INITIAL_POS (a_this, &init_pos); + +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + CHECK_PARSING_STATUS (status, FALSE); + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + + } while (status == CR_OK); + +@@ -955,10 +959,12 @@ cr_parser_parse_selector_core (CRParser * a_this) + *in chapter 4.1 of the css2 spec. + *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*; + *@param a_this the current instance of #CRParser. ++ *@param n_calls used to limit recursion depth + *FIXME: code this function. + */ + static enum CRStatus +-cr_parser_parse_block_core (CRParser * a_this) ++cr_parser_parse_block_core (CRParser * a_this, ++ guint n_calls) + { + CRToken *token = NULL; + CRInputPos init_pos; +@@ -966,6 +972,9 @@ cr_parser_parse_block_core (CRParser * a_this) + + g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR); + ++ if (n_calls > RECURSIVE_CALLERS_LIMIT) ++ return CR_ERROR; ++ + RECORD_INITIAL_POS (a_this, &init_pos); + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token); +@@ -995,13 +1004,13 @@ cr_parser_parse_block_core (CRParser * a_this) + } else if (token->type == CBO_TK) { + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, n_calls + 1); + CHECK_PARSING_STATUS (status, FALSE); + goto parse_block_content; + } else { + cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token); + token = NULL; +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); + CHECK_PARSING_STATUS (status, FALSE); + goto parse_block_content; + } +@@ -1108,7 +1117,7 @@ cr_parser_parse_value_core (CRParser * a_this) + status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_block_core (a_this); ++ status = cr_parser_parse_block_core (a_this, 0); + CHECK_PARSING_STATUS (status, FALSE); + ref++; + goto continue_parsing; +@@ -1122,7 +1131,7 @@ cr_parser_parse_value_core (CRParser * a_this) + status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, + token); + token = NULL; +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, 0); + if (status == CR_OK) { + ref++; + goto continue_parsing; +@@ -1161,10 +1170,12 @@ cr_parser_parse_value_core (CRParser * a_this) + * | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*; + * + *@param a_this the current instance of #CRParser. ++ *@param n_calls used to limit recursion depth + *@return CR_OK upon successfull completion, an error code otherwise. + */ + static enum CRStatus +-cr_parser_parse_any_core (CRParser * a_this) ++cr_parser_parse_any_core (CRParser * a_this, ++ guint n_calls) + { + CRToken *token1 = NULL, + *token2 = NULL; +@@ -1173,6 +1184,9 @@ cr_parser_parse_any_core (CRParser * a_this) + + g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR); + ++ if (n_calls > RECURSIVE_CALLERS_LIMIT) ++ return CR_ERROR; ++ + RECORD_INITIAL_POS (a_this, &init_pos); + + status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1); +@@ -1211,7 +1225,7 @@ cr_parser_parse_any_core (CRParser * a_this) + *We consider parameter as being an "any*" production. + */ + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +@@ -1236,7 +1250,7 @@ cr_parser_parse_any_core (CRParser * a_this) + } + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +@@ -1264,7 +1278,7 @@ cr_parser_parse_any_core (CRParser * a_this) + } + + do { +- status = cr_parser_parse_any_core (a_this); ++ status = cr_parser_parse_any_core (a_this, n_calls + 1); + } while (status == CR_OK); + + ENSURE_PARSING_COND (status == CR_PARSING_ERROR); +-- +GitLab + diff --git a/user/libebml/APKBUILD b/user/libebml/APKBUILD index e9145cd5a..c7b2b1093 100644 --- a/user/libebml/APKBUILD +++ b/user/libebml/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Timo Teräs <timo.teras@iki.fi> # Maintainer: pkgname=libebml -pkgver=1.3.10 +pkgver=1.4.0 pkgrel=0 pkgdesc="Library to parse Extensible Binary Meta-Language files" url="https://www.matroska.org/" @@ -28,4 +28,4 @@ package() { make install DESTDIR="$pkgdir" } -sha512sums="c7ba20664161e811a10847f888a833abaa2b7a4d43ddbef6ae927f391f5d1eff45bc703f13a52ccfc793521e3b22cbac2fd93550cd95119a4060153683b29c49 libebml-1.3.10.tar.xz" +sha512sums="db78ee560a44b90b4df12ba23a00f8ccb0d3626f44296af6b79a492a00126690582764c6be6c9e9851302a0d0d70edfbe000cc217c5532abe862a821624af230 libebml-1.4.0.tar.xz" diff --git a/user/libjpeg-turbo/APKBUILD b/user/libjpeg-turbo/APKBUILD index cbecdd1a4..5910e7011 100644 --- a/user/libjpeg-turbo/APKBUILD +++ b/user/libjpeg-turbo/APKBUILD @@ -1,8 +1,8 @@ # Contributor: Carlo Landmeter <clandmeter@gmail.com> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=libjpeg-turbo -pkgver=2.0.4 -pkgrel=1 +pkgver=2.0.5 +pkgrel=0 pkgdesc="Accelerated JPEG compression and decompression library" url="https://libjpeg-turbo.org/" arch="all" @@ -11,7 +11,6 @@ depends="" makedepends="cmake" subpackages="$pkgname-doc $pkgname-dev $pkgname-utils" source="https://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-$pkgver.tar.gz - CVE-2020-13790.patch " case "$CTARGET_ARCH" in @@ -63,5 +62,4 @@ utils() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="708c2e7418d9ed5abca313e2ff5a08f8176d79cad2127573cda6036583c201973db4cfb0eafc0fc8f57ecc7b000d2b4af95980de54de5a0aed45969e993a5bf9 libjpeg-turbo-2.0.4.tar.gz -83752558d0cf60508a9ccd55505b91f4faa22277537916629a045b2aaa0cb3649e2f90b0df26d389687dc4aba78bdf76e64fc5e5eb324a65026ec86cd95dbe6a CVE-2020-13790.patch" +sha512sums="5bf9ecf069b43783ff24365febf36dda69ccb92d6397efec6069b2b4f359bfd7b87934a6ce4311873220fccc73acabdacef5ce0604b79209eb1912e8ba478555 libjpeg-turbo-2.0.5.tar.gz" diff --git a/user/libjpeg-turbo/CVE-2020-13790.patch b/user/libjpeg-turbo/CVE-2020-13790.patch deleted file mode 100644 index aaeec0c9c..000000000 --- a/user/libjpeg-turbo/CVE-2020-13790.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 3de15e0c344d11d4b90f4a47136467053eb2d09a Mon Sep 17 00:00:00 2001 -From: DRC <information@libjpeg-turbo.org> -Date: Tue, 2 Jun 2020 14:15:37 -0500 -Subject: [PATCH] rdppm.c: Fix buf overrun caused by bad binary PPM - -This extends the fix in 1e81b0c3ea26f4ea8f56de05367469333de64a9f to -include binary PPM files with maximum values < 255, thus preventing a -malformed binary PPM input file with those specifications from -triggering an overrun of the rescale array and potentially crashing -cjpeg, TJBench, or any program that uses the tjLoadImage() function. - -Fixes #433 - -diff --git a/rdppm.c b/rdppm.c -index 87bc33090..a8507b902 100644 ---- a/rdppm.c -+++ b/rdppm.c -@@ -5,7 +5,7 @@ - * Copyright (C) 1991-1997, Thomas G. Lane. - * Modified 2009 by Bill Allombert, Guido Vollbeding. - * libjpeg-turbo Modifications: -- * Copyright (C) 2015-2017, D. R. Commander. -+ * Copyright (C) 2015-2017, 2020, D. R. Commander. - * For conditions of distribution and use, see the accompanying README.ijg - * file. - * -@@ -720,7 +720,7 @@ start_input_ppm(j_compress_ptr cinfo, cjpeg_source_ptr sinfo) - /* On 16-bit-int machines we have to be careful of maxval = 65535 */ - source->rescale = (JSAMPLE *) - (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE, -- (size_t)(((long)maxval + 1L) * -+ (size_t)(((long)MAX(maxval, 255) + 1L) * - sizeof(JSAMPLE))); - half_maxval = maxval / 2; - for (val = 0; val <= (long)maxval; val++) { diff --git a/user/libmatroska/APKBUILD b/user/libmatroska/APKBUILD index 076e9a9e2..de30dc6ba 100644 --- a/user/libmatroska/APKBUILD +++ b/user/libmatroska/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Timo Teräs <timo.teras@iki.fi> # Maintainer: pkgname=libmatroska -pkgver=1.5.2 +pkgver=1.6.2 pkgrel=0 pkgdesc="Library to parse Matroska files" url="https://www.matroska.org/" @@ -28,4 +28,4 @@ package() { make install DESTDIR="$pkgdir" } -sha512sums="122b71b91ae89e2a7cc89db17655a006248d58f18d913b4f9ffc885aef7e39681a3a16eed43cd8ecd949c570a939007797c79829f5ee87d08562aee3f0224ba2 libmatroska-1.5.2.tar.xz" +sha512sums="c0b2b475f01e01b064348e96a4cd25f594e93b21ab6f66236d6872d1242b6076d501c155a19dedd642ded8338c0a71be09450fc086e77802099413c8849abab1 libmatroska-1.6.2.tar.xz" diff --git a/user/libnftnl/APKBUILD b/user/libnftnl/APKBUILD index 9745b8784..d9a3771a0 100644 --- a/user/libnftnl/APKBUILD +++ b/user/libnftnl/APKBUILD @@ -2,7 +2,7 @@ # Contributor: Mira Ressel <aranea@aixah.de> # Maintainer: pkgname=libnftnl -pkgver=1.1.7 +pkgver=1.1.8 pkgrel=0 pkgdesc="Netfilter library providing interface to the nf_tables subsystem" url="https://netfilter.org/projects/libnftnl" @@ -33,4 +33,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="80fd09147b1e2c1533cc2c8347d35137ff94f14118d5ba7bf3c1fbd0a226f6443560d5eca03273129e091b3442f820cd24455e72e917a8b7fedc8f3c9b6dc407 libnftnl-1.1.7.tar.bz2" +sha512sums="173d8a7b95eb964a9fbe7ffcb46541a6bae976b4d4f2a28fbf9b03bf3e50a29b1ea12faa49926d2d33bc088580a833fc6e15ff59a30bcfe67c91c524f00c778e libnftnl-1.1.8.tar.bz2" diff --git a/user/libproxy/APKBUILD b/user/libproxy/APKBUILD index 1cdb0c9b5..7a13ebc05 100644 --- a/user/libproxy/APKBUILD +++ b/user/libproxy/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: pkgname=libproxy pkgver=0.4.15 -pkgrel=2 +pkgrel=3 pkgdesc="Library providing automatic proxy configuration management" url="http://libproxy.github.io/libproxy/" arch="all" @@ -14,8 +14,15 @@ subpackages="$pkgname-dev $pkgname-bin py3-$pkgname:py" source="$pkgname-$pkgver.tar.gz::https://github.com/libproxy/libproxy/archive/$pkgver.tar.gz libproxy-0.4.7-unistd.patch fix-includes.patch + CVE-2020-25219.patch + CVE-2020-26154.patch " +# secfixes: +# 0.4.15-r3: +# - CVE-2020-25219 +# - CVE-2020-26154 + build() { cmake \ -DCMAKE_INSTALL_PREFIX=/usr \ @@ -55,4 +62,6 @@ py() { sha512sums="8f68bd56e44aeb3f553f4657bef82a5d14302780508dafa32454d6f724b724c884ceed6042f8df53a081d26ea0b05598cf35eab44823257c47c5ef8afb36442b libproxy-0.4.15.tar.gz 9929c308195bc59c1b9a7ddaaf708fb831da83c5d86d7ce122cb9774c9b9b16aef3c17fb721356e33a865de1af27db493f29a99d292e1e258cd0135218cacd32 libproxy-0.4.7-unistd.patch -e35b4f806e5f60e9b184d64dceae62e6e343c367ee96d7e461388f2665fe2ab62170d41848c9da5322bb1719eff3bfaecb273e40a97ce940a5e88d29d03bd8d9 fix-includes.patch" +e35b4f806e5f60e9b184d64dceae62e6e343c367ee96d7e461388f2665fe2ab62170d41848c9da5322bb1719eff3bfaecb273e40a97ce940a5e88d29d03bd8d9 fix-includes.patch +908fbf49bec18764a8c2ab81ef5d5e6e1fc2423cf9a6608cc7d3a6d5ac44676e171646b0f95b39b7ade108afd62cc2ede8f7b57d6ba0d67025f30b18e5084292 CVE-2020-25219.patch +01c784a8016bb2a2bf5058b6af7fac29250542bfd4e0679a91fa223c821336d651f8f4a968763072edb86a78a743618c312a2daeb2963c8e5207109f2d26a18f CVE-2020-26154.patch" diff --git a/user/libproxy/CVE-2020-25219.patch b/user/libproxy/CVE-2020-25219.patch new file mode 100644 index 000000000..03cfbc00e --- /dev/null +++ b/user/libproxy/CVE-2020-25219.patch @@ -0,0 +1,57 @@ +From a83dae404feac517695c23ff43ce1e116e2bfbe0 Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro <mcatanzaro@gnome.org> +Date: Wed, 9 Sep 2020 11:12:02 -0500 +Subject: [PATCH] Rewrite url::recvline to be nonrecursive + +This function processes network input. It's semi-trusted, because the +PAC ought to be trusted. But we still shouldn't allow it to control how +far we recurse. A malicious PAC can cause us to overflow the stack by +sending a sufficiently-long line without any '\n' character. + +Also, this function failed to properly handle EINTR, so let's fix that +too, for good measure. + +Fixes #134 +--- + libproxy/url.cpp | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/libproxy/url.cpp b/libproxy/url.cpp +index ee776b2..68d69cd 100644 +--- a/libproxy/url.cpp ++++ b/libproxy/url.cpp +@@ -388,16 +388,24 @@ string url::to_string() const { + return m_orig; + } + +-static inline string recvline(int fd) { +- // Read a character. +- // If we don't get a character, return empty string. +- // If we are at the end of the line, return empty string. +- char c = '\0'; +- +- if (recv(fd, &c, 1, 0) != 1 || c == '\n') +- return ""; +- +- return string(1, c) + recvline(fd); ++static string recvline(int fd) { ++ string line; ++ int ret; ++ ++ // Reserve arbitrary amount of space to avoid small memory reallocations. ++ line.reserve(128); ++ ++ do { ++ char c; ++ ret = recv(fd, &c, 1, 0); ++ if (ret == 1) { ++ if (c == '\n') ++ return line; ++ line += c; ++ } ++ } while (ret == 1 || (ret == -1 && errno == EINTR)); ++ ++ return line; + } + + char* url::get_pac() { diff --git a/user/libproxy/CVE-2020-26154.patch b/user/libproxy/CVE-2020-26154.patch new file mode 100644 index 000000000..929083327 --- /dev/null +++ b/user/libproxy/CVE-2020-26154.patch @@ -0,0 +1,93 @@ +From 4411b523545b22022b4be7d0cac25aa170ae1d3e Mon Sep 17 00:00:00 2001 +From: Fei Li <lifeibiren@gmail.com> +Date: Fri, 17 Jul 2020 02:18:37 +0800 +Subject: [PATCH] Fix buffer overflow when PAC is enabled + +The bug was found on Windows 10 (MINGW64) when PAC is enabled. It turned +out to be the large PAC file (more than 102400 bytes) returned by a +local proxy program with no content-length present. +--- + libproxy/url.cpp | 44 +++++++++++++++++++++++++++++++------------- + 1 file changed, 31 insertions(+), 13 deletions(-) + +diff --git a/libproxy/url.cpp b/libproxy/url.cpp +index ee776b2..8684086 100644 +--- a/libproxy/url.cpp ++++ b/libproxy/url.cpp +@@ -54,7 +54,7 @@ using namespace std; + #define PAC_MIME_TYPE_FB "text/plain" + + // This is the maximum pac size (to avoid memory attacks) +-#define PAC_MAX_SIZE 102400 ++#define PAC_MAX_SIZE 0x800000 + // This is the default block size to use when receiving via HTTP + #define PAC_HTTP_BLOCK_SIZE 512 + +@@ -478,15 +478,13 @@ char* url::get_pac() { + } + + // Get content +- unsigned int recvd = 0; +- buffer = new char[PAC_MAX_SIZE]; +- memset(buffer, 0, PAC_MAX_SIZE); ++ std::vector<char> dynamic_buffer; + do { + unsigned int chunk_length; + + if (chunked) { + // Discard the empty line if we received a previous chunk +- if (recvd > 0) recvline(sock); ++ if (!dynamic_buffer.empty()) recvline(sock); + + // Get the chunk-length line as an integer + if (sscanf(recvline(sock).c_str(), "%x", &chunk_length) != 1 || chunk_length == 0) break; +@@ -498,21 +496,41 @@ char* url::get_pac() { + + if (content_length >= PAC_MAX_SIZE) break; + +- while (content_length == 0 || recvd != content_length) { +- int r = recv(sock, buffer + recvd, +- content_length == 0 ? PAC_HTTP_BLOCK_SIZE +- : content_length - recvd, 0); ++ while (content_length == 0 || dynamic_buffer.size() != content_length) { ++ // Calculate length to recv ++ unsigned int length_to_read = PAC_HTTP_BLOCK_SIZE; ++ if (content_length > 0) ++ length_to_read = content_length - dynamic_buffer.size(); ++ ++ // Prepare buffer ++ dynamic_buffer.resize(dynamic_buffer.size() + length_to_read); ++ ++ int r = recv(sock, dynamic_buffer.data() + dynamic_buffer.size() - length_to_read, length_to_read, 0); ++ ++ // Shrink buffer to fit ++ if (r >= 0) ++ dynamic_buffer.resize(dynamic_buffer.size() - length_to_read + r); ++ ++ // PAC size too large, discard ++ if (dynamic_buffer.size() >= PAC_MAX_SIZE) { ++ chunked = false; ++ dynamic_buffer.clear(); ++ break; ++ } ++ + if (r <= 0) { + chunked = false; + break; + } +- recvd += r; + } + } while (chunked); + +- if (content_length != 0 && string(buffer).size() != content_length) { +- delete[] buffer; +- buffer = NULL; ++ if (content_length == 0 || content_length == dynamic_buffer.size()) { ++ buffer = new char[dynamic_buffer.size() + 1]; ++ if (!dynamic_buffer.empty()) { ++ memcpy(buffer, dynamic_buffer.data(), dynamic_buffer.size()); ++ } ++ buffer[dynamic_buffer.size()] = '\0'; + } + } + diff --git a/user/mbuffer/APKBUILD b/user/mbuffer/APKBUILD new file mode 100644 index 000000000..fbcaeaeb9 --- /dev/null +++ b/user/mbuffer/APKBUILD @@ -0,0 +1,36 @@ +# Contributor: CyberLeo <cyberleo@cyberleo.net> +# Maintainer: CyberLeo <cyberleo@cyberleo.net> +pkgname=mbuffer +pkgver=20200929 +pkgrel=0 +pkgdesc="mbuffer is a tool for buffering data streams." +url="http://www.maier-komor.de/mbuffer.html" +arch="all" +license="GPL-3.0-only" +depends="" +makedepends="" +subpackages="$pkgname-doc" +source="http://www.maier-komor.de/software/mbuffer/mbuffer-$pkgver.tgz + test-static-file-instead.patch" + +build() { + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --prefix=/usr \ + --sysconfdir=/etc \ + --mandir=/usr/share/man \ + --localstatedir=/var + make +} + +check() { + make check +} + +package() { + make DESTDIR="$pkgdir" install +} + +sha512sums="332106205ea8743c9cf47529106c04ac15801a02b116d8e0c0fd3baadad51331c9f4ba1c8fa125edb42940cf401048a45ba23e2dac0e5189671bcf0ecee36996 mbuffer-20200929.tgz +28b7c7c7ee2b2130315cd6c4765d492e9d29376670a03ab0a1ab862a1ec5dea93e91e9de5e08604db69fe4139370eedb2a0754f16e5ebec3de9b48dc2a1dbea7 test-static-file-instead.patch" diff --git a/user/mbuffer/test-static-file-instead.patch b/user/mbuffer/test-static-file-instead.patch new file mode 100644 index 000000000..9c549bfaa --- /dev/null +++ b/user/mbuffer/test-static-file-instead.patch @@ -0,0 +1,11 @@ +--- mbuffer-20200929/Makefile.in.orig 2020-11-08 07:47:44.512670020 +0000 ++++ mbuffer-20200929/Makefile.in 2020-11-08 07:48:33.032115323 +0000 +@@ -101,7 +101,7 @@ + test.tar test.md5 mbuffer.md5 idev.so tapetest.so have-af + + test.tar: +- $(TAR) cf test.tar --ignore-failed-read $(TESTTREE) ++ truncate -s 10M test.tar + + test.md5: test.tar + openssl md5 < test.tar > test.md5 diff --git a/user/meson/APKBUILD b/user/meson/APKBUILD index d975e1460..5164bae64 100644 --- a/user/meson/APKBUILD +++ b/user/meson/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net> # Maintainer: pkgname=meson -pkgver=0.52.1 +pkgver=0.55.3 pkgrel=0 pkgdesc="Fast, user-friendly build system" url="https://mesonbuild.com/" @@ -24,4 +24,4 @@ package() { python3 setup.py install --prefix=/usr --root="$pkgdir" } -sha512sums="81e8c5897ba5311ccffc401fd514bd9a67d16caaea1f28a5c5432605766341ecd82b70c05661fbbe0c9a6006ff5ea892950bbaa548e70c3f87350438775ea6fd meson-0.52.1.tar.gz" +sha512sums="afb0bb25b367e681131d920995124df4b06f6d144ae1a95ebec27be13e06fefbd95840e0287cd1d84bdbb8d9c115b589a833d847c60926f55e0f15749cf66bae meson-0.55.3.tar.gz" diff --git a/user/mlt/APKBUILD b/user/mlt/APKBUILD index dce0dca9f..db451478e 100644 --- a/user/mlt/APKBUILD +++ b/user/mlt/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Carlo Landmeter <clandmeter@gmail.com> # Maintainer: pkgname=mlt -pkgver=6.20.0 +pkgver=6.22.1 pkgrel=0 pkgdesc="MLT multimedia framework" url="https://www.mltframework.org/" @@ -45,5 +45,5 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="939e837fb07ff0eace308987d83913e979f82c6eb156b40fde784f3f2b031b5f6896ac96dcde1627925cbb6fc76725f3fc4e5b2d0616fae11263648bcdbe82e3 mlt-6.20.0.tar.gz +sha512sums="c620b68d35c90eab650c70768a4ae631dec83ece6dd3fd8e09f9300d837d8e0f3da1b098786188f9c1216800f848dd5db7c9e5fa03e816fba3fbcf3c63324c74 mlt-6.22.1.tar.gz d00f01d50d5c78b1da5b43dc2b0bbfc49d5e383b602169ae9554734d29f6d43b9da8f97546141933c06ff0367bb4c9f0d2161bbcb6f016265bb0aa1dcbfcb3b1 mlt-6.14.0-locale-header.patch" diff --git a/user/mtr/APKBUILD b/user/mtr/APKBUILD index 59fc8a203..6ffdf8627 100644 --- a/user/mtr/APKBUILD +++ b/user/mtr/APKBUILD @@ -1,7 +1,7 @@ # Contributor: John Keith Hohm <john@hohm.net> # Maintainer: pkgname=mtr -pkgver=0.93 +pkgver=0.94 pkgrel=0 pkgdesc="Full screen ncurses traceroute tool" url="https://www.bitwizard.nl/mtr/" @@ -56,6 +56,6 @@ gtk() { rm -r "$subpkgdir"/usr/share/man } -sha512sums="865c394d8dfa234c472832dc205ddc9ec3cf0552475f565782fd4f4e878251c03f1473e2d28d6799e59da4fcb33c5355049f1e6f02e8610c6bbf681ffb78f53e mtr-0.93.tar.gz +sha512sums="0e58bd79562ff80f9308135562ab22aa1f1eea686aefd3aef07bac05e661e34b60fde7c66c96bf4f0919f546376fbd6106ecd8fa92328c24f6f903097496bf11 mtr-0.94.tar.gz 60c11b27c4d20a75010cadc31d5c1ac94094aaaee0c2f0ad14246b00b0d5301f581ef55eaefa48692d4449a8e7580e67abbb58ea3183fae8f449f7969242f1a9 handle-program-suffix.patch ecf7543e0125fad6d3f17c30f29f1fc8a3b1e2e477802fe8464e436c3cdfa30d0630b8543cc3f022c475228e94ac8f92981df4d8fb08fe01d004be3d78d6da77 mtr-gtk.desktop" diff --git a/user/re2c/APKBUILD b/user/re2c/APKBUILD index aad7b839e..3293c610d 100644 --- a/user/re2c/APKBUILD +++ b/user/re2c/APKBUILD @@ -1,8 +1,8 @@ # Contributor: Jeff Bilyk <jbilyk at gmail> # Maintainer: pkgname=re2c -pkgver=1.3 -pkgrel=1 +pkgver=2.0.3 +pkgrel=0 pkgdesc="Fast lexer generator for C and C++" url="http://re2c.org/" arch="all" @@ -12,13 +12,13 @@ checkdepends="bash" makedepends="" subpackages="$pkgname-doc" source="https://github.com/skvadrik/re2c/releases/download/$pkgver/$pkgname-$pkgver.tar.xz - CVE-2020-11958.patch " # secfixes: # 1.3-r1: # - CVE-2020-11958 + build() { ./configure \ --build=$CBUILD \ @@ -38,5 +38,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="c7084ab2399fb6b96cef74c1393715d90830f43b82b96af46feb71ef008c0215381c3dbea0b003ff810d869db6021e28001b9d588ad55c616642244b2da09c0e re2c-1.3.tar.xz -f4376b8e0724d500f665fa60dfd6fb35685a281af50c500d2ff90d781a829fb78f21e8c93c5745a4519acd55a62ec48a570dbfacf0a9ee977502e06f3e2e474a CVE-2020-11958.patch" +sha512sums="893c533e9847a6236d55ae65e413ddc48b7531b89f5552a3ad79beeac079317ceca4c35710f3c2d88a6de5a3c0a5070a24a8cffb1b4277578a41697ea0e3bf8c re2c-2.0.3.tar.xz" diff --git a/user/re2c/CVE-2020-11958.patch b/user/re2c/CVE-2020-11958.patch deleted file mode 100644 index b982b87e6..000000000 --- a/user/re2c/CVE-2020-11958.patch +++ /dev/null @@ -1,37 +0,0 @@ -From c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a Mon Sep 17 00:00:00 2001 -From: Ulya Trofimovich <skvadrik@gmail.com> -Date: Fri, 17 Apr 2020 22:47:14 +0100 -Subject: [PATCH] Fix crash in lexer refill (reported by Agostino Sarubbo). - -The crash happened in a rare case of a very long lexeme that doen't fit -into the buffer, forcing buffer reallocation. - -The crash was caused by an incorrect calculation of the shift offset -(it was smaller than necessary). As a consequence, the data from buffer -start and up to the beginning of the current lexeme was not discarded -(as it should have been), resulting in less free space for new data than -expected. ---- - src/parse/scanner.cc | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/parse/scanner.cc b/src/parse/scanner.cc -index 1d6e9efa..bd651314 100644 ---- a/src/parse/scanner.cc -+++ b/src/parse/scanner.cc -@@ -155,13 +155,14 @@ bool Scanner::fill(size_t need) - if (!buf) fatal("out of memory"); - - memmove(buf, tok, copy); -- shift_ptrs_and_fpos(buf - bot); -+ shift_ptrs_and_fpos(buf - tok); - delete [] bot; - bot = buf; - - free = BSIZE - copy; - } - -+ DASSERT(lim + free <= bot + BSIZE); - if (!read(free)) { - eof = lim; - memset(lim, 0, YYMAXFILL); diff --git a/user/trojita/APKBUILD b/user/trojita/APKBUILD index c55e5453c..3dd6a5ab6 100644 --- a/user/trojita/APKBUILD +++ b/user/trojita/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Kiyoshi Aman <adelie@aerdan.vulpine.house> pkgname=trojita pkgver=0.7 -pkgrel=0 +pkgrel=1 pkgdesc="Qt-based IMAP email client" url="http://trojita.flaska.net/" arch="all" @@ -15,7 +15,15 @@ makedepends="cmake extra-cmake-modules zlib-dev qt5-qtbase-dev qt5-qtwebkit-dev qtkeychain-dev" source="https://sourceforge.net/projects/trojita/files/src/trojita-$pkgver.tar.xz use-qgpgme.patch - fix-gpg.patch" + fix-gpg.patch + CVE-2019-10734.patch + CVE-2020-15047.patch + " + +# secfixes: +# 0.7-r1: +# - CVE-2019-10734 +# - CVE-2020-15047 build() { if [ "$CBUILD" != "$CHOST" ]; then @@ -34,7 +42,8 @@ build() { } check() { - CTEST_OUTPUT_ON_FAILURE=TRUE ctest + # test_Html_formatting: requires X11 + CTEST_OUTPUT_ON_FAILURE=TRUE ctest -E test_Html_formatting } package() { @@ -43,4 +52,6 @@ package() { sha512sums="fe4d9316f97d913619f27d24a5023c3d8dd4a6b9fb058651be12c67188f394aa8cbb60c7593e5eb28fc12fc883b76deeeb5f4f631edd255fdec4c5862c9a91c8 trojita-0.7.tar.xz 740c2410d7236d722482f05dd1d2c681e35543620823cb7c1396710081f9de4f6ae530c5b5442ecf5d08a8e552f0697f3a35bf51e07a3b4336dec7021b665706 use-qgpgme.patch -9d0fbf7c0b0f6975990a7705f9d43043e5807401cee179d7a07f9514856332d6bb1aa8448e84d0083003c34a3bb181080b973e8c1f77d1b5a8930d07d57702da fix-gpg.patch" +9d0fbf7c0b0f6975990a7705f9d43043e5807401cee179d7a07f9514856332d6bb1aa8448e84d0083003c34a3bb181080b973e8c1f77d1b5a8930d07d57702da fix-gpg.patch +db96a566924b5d7b80787ab624af3726d5dd3459653192436a377d6482ab73801a7dcca1df1b1d937cf0d0798b827e04f8ef2c1124f91dc9da3e8036ef61e28a CVE-2019-10734.patch +2477612aca1e558fa3ba2b434a701cc255c573ac7e2001e7b5921c9b991f7c95720f53b70b49824e36bafb53ab53477950cb8d436e637fda4d59c7ec5883ce5f CVE-2020-15047.patch" diff --git a/user/trojita/CVE-2019-10734.patch b/user/trojita/CVE-2019-10734.patch new file mode 100644 index 000000000..d52edb042 --- /dev/null +++ b/user/trojita/CVE-2019-10734.patch @@ -0,0 +1,104 @@ +From 8db7f450d52539b4c72ee968384911b6813ad1e7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jkt@kde.org> +Date: Thu, 25 Jun 2020 21:39:34 +0200 +Subject: [PATCH] Prevent a possible decryption oracle attack +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Thanks to Jens Mueller (Ruhr-Uni Bochum and FH Münster) for reporting +this. The gist is that an attacker can embed arbitrary ciphertext into +their messages. Trojita decrypts that, and when we hit reply, the +original *cleartext* gets quoted and put into a reply for the attacker +to see. + +Fix this by not quoting any plaintext which originated in an encrypted +message. That's pretty draconian, but hey, it works and we never came up +with any better patch. Also, given that Trojita does not encrypt +outgoing messages yet, this is probably also a conservative thing to do. + +Change-Id: I84c45b9e707eb7c99eb7183c6ef59ef41cd62c43 +CVE: CVE-2019-10734 +BUG: 404697 +--- + src/Cryptography/GpgMe++.cpp | 2 ++ + src/Gui/MessageView.cpp | 9 ++++++++- + src/Gui/PartWidget.cpp | 8 ++++++++ + src/Imap/Model/ItemRoles.h | 2 +- + 4 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/src/Cryptography/GpgMe++.cpp b/src/Cryptography/GpgMe++.cpp +index e012f603..716b8aff 100644 +--- a/src/Cryptography/GpgMe++.cpp ++++ b/src/Cryptography/GpgMe++.cpp +@@ -267,6 +267,8 @@ QVariant GpgMePart::data(int role) const + switch (role) { + case Imap::Mailbox::RolePartSignatureVerifySupported: + return m_wasSigned; ++ case RolePartDecryptionSupported: ++ return m_isAllegedlyEncrypted; + case RolePartCryptoNotFinishedYet: + return m_waitingForData || + (m_crypto.valid() && +diff --git a/src/Gui/MessageView.cpp b/src/Gui/MessageView.cpp +index 7d649308..c95e0878 100644 +--- a/src/Gui/MessageView.cpp ++++ b/src/Gui/MessageView.cpp +@@ -354,7 +354,6 @@ bool MessageView::eventFilter(QObject *object, QEvent *event) + QString MessageView::quoteText() const + { + if (auto w = bodyWidget()) { +- QStringList quote = Composer::quoteText(w->quoteMe().split(QLatin1Char('\n'))); + const Imap::Message::Envelope &e = message.data(Imap::Mailbox::RoleMessageEnvelope).value<Imap::Message::Envelope>(); + QString sender; + if (!e.from.isEmpty()) +@@ -362,6 +361,14 @@ QString MessageView::quoteText() const + if (e.from.isEmpty()) + sender = tr("you"); + ++ if (messageModel->index(0, 0) /* fake message root */.child(0, 0) /* first MIME part */.data(Imap::Mailbox::RolePartDecryptionSupported).toBool()) { ++ // This is just an UX improvement shortcut: real filtering for CVE-2019-10734 is in ++ // MultipartSignedEncryptedWidget::quoteMe(). ++ // That is required because the encrypted part might not be the root part of the message. ++ return tr("On %1, %2 sent an encrypted message:\n> ...\n\n").arg(e.date.toLocalTime().toString(Qt::SystemLocaleLongDate), sender); ++ } ++ ++ QStringList quote = Composer::quoteText(w->quoteMe().split(QLatin1Char('\n'))); + // One extra newline at the end of the quoted text to separate the response + quote << QString(); + +diff --git a/src/Gui/PartWidget.cpp b/src/Gui/PartWidget.cpp +index bb27604d..96eff338 100644 +--- a/src/Gui/PartWidget.cpp ++++ b/src/Gui/PartWidget.cpp +@@ -378,6 +378,14 @@ void MultipartSignedEncryptedWidget::updateStatusIndicator() + + QString MultipartSignedEncryptedWidget::quoteMe() const + { ++ if (m_partIndex.data(Imap::Mailbox::RolePartDecryptionSupported).toBool()) { ++ // See CVE-2019-10734, the point is not to leak cleartext from encrypted content. Even when Trojita starts supporting ++ // encryption of outgoing mail, we will have to check whether the encrypted cleartext is from the same sender, whether ++ // it matches the list of recipients (which is dynamic and can be set later on), etc etc. ++ // TL;DR, this is a can of worms. ++ return tr("[Encrypted message]"); ++ } ++ + return quoteMeHelper(children()); + } + +diff --git a/src/Imap/Model/ItemRoles.h b/src/Imap/Model/ItemRoles.h +index 4588d4d0..00adb3bb 100644 +--- a/src/Imap/Model/ItemRoles.h ++++ b/src/Imap/Model/ItemRoles.h +@@ -193,7 +193,7 @@ enum { + RolePartSignatureVerifySupported, + /** @short Is the format of this particular multipart/encrypted supported and recognized? + +- See RolePartSignatureVerifySupported, this is an equivalent. ++ If true, this message part represents content of an encrypted message that Trojita can attempt to decrypt. + */ + RolePartDecryptionSupported, + /** @short Is there any point in waiting longer? +-- +GitLab + diff --git a/user/trojita/CVE-2020-15047.patch b/user/trojita/CVE-2020-15047.patch new file mode 100644 index 000000000..6199c01fd --- /dev/null +++ b/user/trojita/CVE-2020-15047.patch @@ -0,0 +1,88 @@ +From 77ddd5d44f2bf4155d0c9b6f7d05f01713b32d5d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jkt@kde.org> +Date: Thu, 25 Jun 2020 11:30:51 +0200 +Subject: [PATCH] SMTP: Do not ignore TLS errors + +This fixes a CVE-2020-15047 (category: CWE-295). Since commit 0083eea5ed +which added initial, experimental support for SMTP message submission, +we have apparently never implemented proper SSL/TLS error handling, and +the code has ever since just kept silently ignoring any certificate +verification errors. As a result, Trojita was susceptible to a MITM +attack when sending e-mails. The information leaked include user's +authentication details, including the password, and the content of sent +messages. + +Sorry for this :(. + +Now, this patch re-enabes proper TLS error handling. It was not possible +to directly re-use our code for TLS key pinning which we are using for +IMAP connections. In the Qt TLS code, the decision to accept or not +accept a TLS connection is a blocking one, so the IMAP code relies upon +the protocol state machine (i.e., another layer) for deciding whether to +use or not to use the just-established TLS connection. Implementing an +equivalent code in the SMTP library would be nice, but this hot-fix has +a priority. As a result, SMTP connections to hosts with, e.g., +self-signed TLS certs, are no longer possible. Let's hope that this is +not a practical problem with Lets Encrypt anymore. + +Thanks to Damian Poddebniak for reporting this bug. + +Change-Id: Icd6bbb2b0fb3e45159fc9699ebd07ab84262fe37 +CVE: CVE-2020-15047 +BUG: 423453 +--- + src/MSA/SMTP.cpp | 11 +++++++++-- + src/MSA/SMTP.h | 1 + + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/src/MSA/SMTP.cpp b/src/MSA/SMTP.cpp +index 3a054516..ac1eefc5 100644 +--- a/src/MSA/SMTP.cpp ++++ b/src/MSA/SMTP.cpp +@@ -21,6 +21,7 @@ + along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + #include "SMTP.h" ++#include "UiUtils/Formatting.h" + + namespace MSA + { +@@ -32,8 +33,8 @@ SMTP::SMTP(QObject *parent, const QString &host, quint16 port, bool encryptedCon + user(user), failed(false), isWaitingForPassword(false), sendingMode(MODE_SMTP_INVALID) + { + qwwSmtp = new QwwSmtpClient(this); +- // FIXME: handle SSL errors properly +- connect(qwwSmtp, &QwwSmtpClient::sslErrors, qwwSmtp, &QwwSmtpClient::ignoreSslErrors); ++ // FIXME: handle SSL errors in the same way as we handle IMAP TLS errors, with key pinning, etc. ++ connect(qwwSmtp, &QwwSmtpClient::sslErrors, this, &SMTP::handleSslErrors); + connect(qwwSmtp, &QwwSmtpClient::connected, this, &AbstractMSA::sending); + connect(qwwSmtp, &QwwSmtpClient::done, this, &SMTP::handleDone); + connect(qwwSmtp, &QwwSmtpClient::socketError, this, &SMTP::handleError); +@@ -78,6 +79,12 @@ void SMTP::handleError(QAbstractSocket::SocketError err, const QString &msg) + emit error(msg); + } + ++void SMTP::handleSslErrors(const QList<QSslError>& errors) ++{ ++ auto msg = UiUtils::Formatting::sslErrorsToHtml(errors); ++ emit error(tr("<p>Cannot send message due to an SSL/TLS error</p>\n%1").arg(msg)); ++} ++ + void SMTP::setPassword(const QString &password) + { + pass = password; +diff --git a/src/MSA/SMTP.h b/src/MSA/SMTP.h +index 453407d3..913bb873 100644 +--- a/src/MSA/SMTP.h ++++ b/src/MSA/SMTP.h +@@ -43,6 +43,7 @@ public slots: + virtual void setPassword(const QString &password); + void handleDone(bool ok); + void handleError(QAbstractSocket::SocketError err, const QString &msg); ++ void handleSslErrors(const QList<QSslError>& errors); + private: + QwwSmtpClient *qwwSmtp; + QString host; +-- +GitLab + diff --git a/user/unixodbc/APKBUILD b/user/unixodbc/APKBUILD index 03f3c78cc..592feea9b 100644 --- a/user/unixodbc/APKBUILD +++ b/user/unixodbc/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Carlo Landmeter <clandmeter@gmail.com> # Maintainer: pkgname=unixodbc -pkgver=2.3.7 +pkgver=2.3.9 pkgrel=0 pkgdesc="Unix ODBC driver manager and database drivers" url="http://www.unixodbc.org/" @@ -30,4 +30,4 @@ package() { make -j1 DESTDIR="$pkgdir" install } -sha512sums="a87afeaaa0476f4ae6345c7021b3af52718944e599abb595c864d9126744a21341889802512a1de3ebaf86ac89e7f8b1bbd7f8f5285e8f4bccf928bd1585ff70 unixODBC-2.3.7.tar.gz" +sha512sums="6637eab751401522e0af775cb104cd07693b82927453a98e5af28e079f4b9f40e1cfab8cb36f509c46dced89b45244bc5ed1a3dda17ba5a52a844e8e82f187bb unixODBC-2.3.9.tar.gz" diff --git a/user/vlc/APKBUILD b/user/vlc/APKBUILD index 13fefc76c..fb508f43b 100644 --- a/user/vlc/APKBUILD +++ b/user/vlc/APKBUILD @@ -2,7 +2,7 @@ # Contributor: Leonardo Arena <rnalrd@alpinelinux.org> # Maintainer: A. Wilcox <awilfox@adelielinux.org> pkgname=vlc -pkgver=3.0.11 +pkgver=3.0.11.1 pkgrel=0 pkgdesc="Multi-platform MPEG, VCD/DVD, and DivX player" triggers="vlc-libs.trigger=/usr/lib/vlc/plugins" @@ -205,7 +205,7 @@ libs() { default_libs } -sha512sums="8219cc46e434c7b2f12321d4e1b21eae123a546eeb22f768c463537a4a4986ab395053f8a794628cfd17236f81665f12b2b3f6867af73b102b81628204b6c444 vlc-3.0.11.tar.xz +sha512sums="8ce1e2f11aabf847dc5c55cf21ce6d7c0419a1051b5f4795e36cd060eab82d5056e44b4c070b80af56744e6aa841ef538386d08bc3b397a444e7258b2ba3f76b vlc-3.0.11.1.tar.xz 22d80df599b8b65a5439cefbb7140af8e9530f326d54945da3769af65f37518b99ec2cc8647aafd2763324a0698280915afe043cc87e5720c4694881ed35bffa check-headless.patch e214b407235cb3afb8bec93f20c9b42957b57e6fd3960679d3d4235e77762e03e64d03c01f00ef63d589e7c85aaad02ce6abbeeccd66b1867bc92451a5b5e9b0 disable-sub-autodetect-fuzzy-1-test.patch e063c727d952465bbea33f669db49190427521dc8e2291e9a5cbb0f5e8e879bd3ba76855e44bd4630948e30c4329d27bd928f95de20fe1050d5e839778a4d012 endian-fix.patch diff --git a/user/wavpack/APKBUILD b/user/wavpack/APKBUILD index 43aefeb03..f0c45a722 100644 --- a/user/wavpack/APKBUILD +++ b/user/wavpack/APKBUILD @@ -2,8 +2,8 @@ # Contributor: Carlo Landmeter # Maintainer: pkgname=wavpack -pkgver=5.2.0 -pkgrel=1 +pkgver=5.3.0 +pkgrel=0 pkgdesc="Audio compression format with lossless, lossy, and hybrid compression modes" url="http://www.wavpack.com/" arch="all" @@ -59,4 +59,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="456da78fb5d01b33a8ed71b43cb6809a25ca0d54e53858b93bbb3eb26923bfa6de4c6a3c01caca947c0852aea74d1b14667205dae344148a01619e67eb2c7e71 wavpack-5.2.0.tar.bz2" +sha512sums="2c5038abfbe7ab3b51fb30b3fc8b636117e9afe1821c40832fbdfb960d1153e0cb4a68dd84a89b205c3cdc10030d3aa7a7340b296d9c148e8847471c2e7c0cd1 wavpack-5.3.0.tar.bz2" diff --git a/user/xapian-core/APKBUILD b/user/xapian-core/APKBUILD index a7c352fa3..85f8f8f89 100644 --- a/user/xapian-core/APKBUILD +++ b/user/xapian-core/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Francesco Colista <fcolista@alpinelinux.org> # Maintainer: pkgname=xapian-core -pkgver=1.4.16 +pkgver=1.4.17 pkgrel=0 pkgdesc="Open source search engine library" url="https://xapian.org/" @@ -46,5 +46,5 @@ libxapian() { mv "$pkgdir"/usr/lib/$subpkgname* "$subpkgdir"/usr/lib } -sha512sums="3d319ab672485e840019ee28b54b1c59bbd535c1802874f58593fb999681c19bff3e776dc19ab5d5bd97734bf01f1408f36ae49e21ca9706ca187db49f8a18a6 xapian-core-1.4.16.tar.xz +sha512sums="3eaf45d31eb9318e292fa052b32b1d9e1035651bdd3c366a0134f4b39d03d987083c19426a3d4b10f60078190fc3388f05b332cba958263bab1abf236c7a3ca7 xapian-core-1.4.17.tar.xz 639c0ecd75be0627d334628b5adf581a7da92c4f86dfb86a92669368ff8a874d4bf4e344b8f3b1276d22d126d2bc44c8ab727e39e1c29c0358fe7bbc8aa8050d timeval-t.patch" diff --git a/user/yubikey-personalization/APKBUILD b/user/yubikey-personalization/APKBUILD index 1db97be94..3ff2ce728 100644 --- a/user/yubikey-personalization/APKBUILD +++ b/user/yubikey-personalization/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: Kiyoshi Aman <adelie@aerdan.vulpine.house> pkgname=yubikey-personalization pkgver=1.20.0 -pkgrel=0 +pkgrel=1 pkgdesc="Cross-platform library & tools for personalizing YubiKey devices" url="https://developers.yubico.com/yubikey-personalization/" arch="all" @@ -13,6 +13,7 @@ makedepends="yubico-c-dev libusb-dev json-c-dev asciidoctor subpackages="$pkgname-dev $pkgname-doc" source="yubikey-personalization-$pkgver.tar.gz::https://github.com/Yubico/yubikey-personalization/archive/v$pkgver.tar.gz use-asciidoctor.patch + json_c.patch " prepare() { @@ -40,4 +41,5 @@ package() { } sha512sums="a38b26700793f0a801e5f5889bbbce4a3f728d22aaecf8d0890f1b5135e67bed16a78b7a36dbc323c5d296901f6dd420fa658a982492a0cd9f0bbf95a5fbc823 yubikey-personalization-1.20.0.tar.gz -d6777a43e5e57430268bb50ab704641465a7314b15fc821d8bfa7f0c6510829d0118ced426cd5f8730589efe6264df6b82fc70e8bfe3d8b7d735e51339a25af2 use-asciidoctor.patch" +d6777a43e5e57430268bb50ab704641465a7314b15fc821d8bfa7f0c6510829d0118ced426cd5f8730589efe6264df6b82fc70e8bfe3d8b7d735e51339a25af2 use-asciidoctor.patch +a8bc7ae71d0a05476688abfaea070ca7dc2eaa68e033524d4a1b2b6240eec2932d867e9eeaa248874a04f254618cd79bf9ebaa17421938b0c2e62502bf90c055 json_c.patch" diff --git a/user/yubikey-personalization/json_c.patch b/user/yubikey-personalization/json_c.patch new file mode 100644 index 000000000..ca5a918d2 --- /dev/null +++ b/user/yubikey-personalization/json_c.patch @@ -0,0 +1,83 @@ +From 0aa2e2cae2e1777863993a10c809bb50f4cde7f8 Mon Sep 17 00:00:00 2001 +From: Christian Hesse <mail@eworm.de> +Date: Sat, 25 Apr 2020 20:55:28 +0200 +Subject: [PATCH] fix boolean value with json-c 0.14 + +Upstream removed the TRUE and FALSE defines in commit +0992aac61f8b087efd7094e9ac2b84fa9c040fcd. +--- + ykpers-json.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/ykpers-json.c b/ykpers-json.c +index a62e907..15ad380 100644 +--- a/ykpers-json.c ++++ b/ykpers-json.c +@@ -40,7 +40,7 @@ + #define yk_json_object_object_get(obj, key, value) json_object_object_get_ex(obj, key, &value) + #else + typedef int json_bool; +-#define yk_json_object_object_get(obj, key, value) (value = json_object_object_get(obj, key)) == NULL ? (json_bool)FALSE : (json_bool)TRUE ++#define yk_json_object_object_get(obj, key, value) (value = json_object_object_get(obj, key)) == NULL ? 0 : 1 + #endif + + static void set_json_value(struct map_st *p, int mode, json_object *options, YKP_CONFIG *cfg) { +@@ -50,7 +50,7 @@ static void set_json_value(struct map_st *p, int mode, json_object *options, YKP + if(p->mode && (mode & p->mode) == mode) { + json_object *joption; + json_bool ret = yk_json_object_object_get(options, p->json_text, joption); +- if(ret == TRUE && json_object_get_type(joption) == json_type_boolean) { ++ if(ret == 1 && json_object_get_type(joption) == json_type_boolean) { + int value = json_object_get_boolean(joption); + if(value == 1) { + p->setter(cfg, true); +@@ -230,20 +230,20 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) { + ykp_errno = YKP_EINVAL; + goto out; + } +- if(yk_json_object_object_get(jobj, "yubiProdConfig", yprod_json) == FALSE) { ++ if(yk_json_object_object_get(jobj, "yubiProdConfig", yprod_json) == 0) { + ykp_errno = YKP_EINVAL; + goto out; + } +- if(yk_json_object_object_get(yprod_json, "mode", jmode) == FALSE) { ++ if(yk_json_object_object_get(yprod_json, "mode", jmode) == 0) { + ykp_errno = YKP_EINVAL; + goto out; + } +- if(yk_json_object_object_get(yprod_json, "options", options) == FALSE) { ++ if(yk_json_object_object_get(yprod_json, "options", options) == 0) { + ykp_errno = YKP_EINVAL; + goto out; + } + +- if(yk_json_object_object_get(yprod_json, "targetConfig", jtarget) == TRUE) { ++ if(yk_json_object_object_get(yprod_json, "targetConfig", jtarget) == 1) { + int target_config = json_object_get_int(jtarget); + int command; + if(target_config == 1) { +@@ -275,13 +275,13 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) { + if(mode == MODE_OATH_HOTP) { + json_object *jdigits, *jrandom; + ykp_set_tktflag_OATH_HOTP(cfg, true); +- if(yk_json_object_object_get(options, "oathDigits", jdigits) == TRUE) { ++ if(yk_json_object_object_get(options, "oathDigits", jdigits) == 1) { + int digits = json_object_get_int(jdigits); + if(digits == 8) { + ykp_set_cfgflag_OATH_HOTP8(cfg, true); + } + } +- if(yk_json_object_object_get(options, "randomSeed", jrandom) == TRUE) { ++ if(yk_json_object_object_get(options, "randomSeed", jrandom) == 1) { + int random = json_object_get_boolean(jrandom); + int seed = 0; + if(random == 1) { +@@ -290,7 +290,7 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) { + goto out; + } else { + json_object *jseed; +- if(yk_json_object_object_get(options, "fixedSeedvalue", jseed) == TRUE) { ++ if(yk_json_object_object_get(options, "fixedSeedvalue", jseed) == 1) { + seed = json_object_get_int(jseed); + } + } |