From 954dcc16c6c5c1c7513b180bcf1e7704b7e3f707 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Tue, 2 Jun 2020 19:54:29 -0500 Subject: user/gnutls: [CVE] bump to 3.6.14 (#254) --- user/gnutls/APKBUILD | 17 +++++++++++------ user/gnutls/disable-certtool-test.patch | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 6 deletions(-) create mode 100644 user/gnutls/disable-certtool-test.patch (limited to 'user') diff --git a/user/gnutls/APKBUILD b/user/gnutls/APKBUILD index 616793f57..e75b1d552 100644 --- a/user/gnutls/APKBUILD +++ b/user/gnutls/APKBUILD @@ -2,12 +2,11 @@ # Contributor: Michael Mason # Maintainer: pkgname=gnutls -pkgver=3.6.11.1 +pkgver=3.6.14 pkgrel=0 pkgdesc="A TLS protocol implementation" -url="http://www.gnutls.org/" +url="https://www.gnutls.org/" arch="all" -options="!check" # https://gitlab.com/gnutls/gnutls/issues/560 license="LGPL-2.1+" makedepends="libtasn1-dev libunistring-dev nettle-dev p11-kit-dev texinfo unbound-dev cmd:which zlib-dev" @@ -23,11 +22,16 @@ case $pkgver in ;; esac source="https://www.gnupg.org/ftp/gcrypt/gnutls/v${_v}/$pkgname-$pkgver.tar.xz - gnulib-tests-dont-require-gpg-passphrase.patch" + gnulib-tests-dont-require-gpg-passphrase.patch + disable-certtool-test.patch + " # secfixes: # 3.5.13-r0: # - CVE-2017-7507 +# 3.6.14-r0: +# - CVE-2020-11501 +# - CVE-2020-13777 build() { LIBS="-lgmp" ./configure \ @@ -79,5 +83,6 @@ xx() { mv "$pkgdir"/usr/lib/lib*xx.so.* "$subpkgdir"/usr/lib/ } -sha512sums="55fbbf0ebc824fbc91ccd08d1708452c5b1c12af75e332f29414540eb2f81337fa605a693ce9f34319a927e9d71177e6e7ffea5c6747792d341fb740f68c9489 gnutls-3.6.11.1.tar.xz -abc24ee59cc67805fe953535b0bae33080fc8b0bf788304377f6d10ec8c162c4cf203a69c98a4ba3483b4c60ed7a204433cc7db9b8190eddb0d68f6fb6dad52d gnulib-tests-dont-require-gpg-passphrase.patch" +sha512sums="b2d427b5542a4679117c011dffa8efb0e0bffa3ce9cebc319f8998d03f80f4168d08f9fda35df18dbeaaada59e479d325a6c1c77d5ca7f8ce221b44e42bfe604 gnutls-3.6.14.tar.xz +abc24ee59cc67805fe953535b0bae33080fc8b0bf788304377f6d10ec8c162c4cf203a69c98a4ba3483b4c60ed7a204433cc7db9b8190eddb0d68f6fb6dad52d gnulib-tests-dont-require-gpg-passphrase.patch +25400be364c1f27b88451002a471cbf841b9738dd93c42dcbeaf7644c3deea6afc85300b40d5ae32d29dc4d441237e8b311f3e07f0af2fb4788701ee4e240c0f disable-certtool-test.patch" diff --git a/user/gnutls/disable-certtool-test.patch b/user/gnutls/disable-certtool-test.patch new file mode 100644 index 000000000..2ae16a38e --- /dev/null +++ b/user/gnutls/disable-certtool-test.patch @@ -0,0 +1,33 @@ +If GNUTLS_PIN is not available in the environment, the test will fail +because it cannot ask for the password: + +Generating a self signed certificate... +No PIN given. +note: when operating in batch mode, set the GNUTLS_PIN or GNUTLS_SO_PIN environment variables +cert generation failed +FAIL certtool (exit status: 1) + +The comment above this line says "some CI runners need GNUTLS_PIN +(GNUTLS_PIN=${PASS})" (i.e. GNUTLS_PIN=1234). When this is passed +instead, the test fails again because "No password was asked" (it greps +for "Enter password" in the output, but this won't happen because +GNUTLS_PIN is set). + +The folks at Nix believe this is an incompatibility due to musl's +getpass not falling back to stdin/stderr if it cannot connect to a tty, +as glibc does. + +https://gitlab.com/gnutls/gnutls/-/issues/945 + +--- gnutls-3.6.13/tests/cert-tests/certtool 2020-01-01 14:10:19.000000000 -0600 ++++ gnutls-3.6.13/tests/cert-tests/certtool 2020-06-02 20:36:20.380039844 -0500 +@@ -20,6 +20,9 @@ + + #set -e + ++echo 'this test is not compatible with musl' ++exit 77 ++ + srcdir="${srcdir:-.}" + CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}" + DIFF="${DIFF:-diff -b -B}" -- cgit v1.2.3-60-g2f50 From ecbcfd73ac4ced9aff3683017b45536c7a5ebdc6 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 11:46:11 -0500 Subject: user/freetds: [CVE] bump to 1.1.40 (#293) --- user/freetds/APKBUILD | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'user') diff --git a/user/freetds/APKBUILD b/user/freetds/APKBUILD index 3687b3cdc..0dd8562cf 100644 --- a/user/freetds/APKBUILD +++ b/user/freetds/APKBUILD @@ -1,7 +1,7 @@ # Contributor: Michael Mason # Maintainer: A. Wilcox pkgname=freetds -pkgver=1.1.6 +pkgver=1.1.40 pkgrel=0 pkgdesc="Library for accessing Sybase and MS SQL Server databases" url="https://www.freetds.org/" @@ -13,6 +13,10 @@ subpackages="$pkgname-doc $pkgname-dev" source="ftp://ftp.freetds.org/pub/freetds/stable/$pkgname-$pkgver.tar.gz fix-includes.patch" +# secfixes: +# 1.1.40-r0: +# - CVE-2019-13508 + build() { ./configure \ --build=$CBUILD \ @@ -36,5 +40,5 @@ package() { make -j1 DESTDIR="$pkgdir" install } -sha512sums="fcd3ed52ffbf482535d8d343b2d45c999875d2bfcbf13ef72a15f4440c791ff138b839798bad05593428c0839981e667133473f7d76570e0de3ebf9e474ea632 freetds-1.1.6.tar.gz +sha512sums="03f6d1e7f57f69068771e1706bbe4a3131e82b00f0191c988ec7d25f571d07caba9ef61598dc381eace1b1e88bc74af8f8506bd79236f9be15a56419a3e5c4c0 freetds-1.1.40.tar.gz d75d1aab6687586697f3e430db1e82f21208f10076b45996542eea682e36cbbbb344f479a9336fcfd294b5b87d7acb2ec5fb8ddd1914e990e23dd5e7ae93a0b6 fix-includes.patch" -- cgit v1.2.3-60-g2f50 From ddb2347a2da3758bfd6bc10dabf5e636c638626a Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 12:08:13 -0500 Subject: user/libexif: [CVE] bump to 0.6.22 (#285) Upstream is now on GitHub according to the old SF page: "Development has moved to https://github.com/libexif/" --- user/libexif/APKBUILD | 26 ++++----- user/libexif/CVE-2016-6328.patch | 60 -------------------- user/libexif/CVE-2017-7544.patch | 30 ---------- user/libexif/CVE-2018-20030.patch | 115 -------------------------------------- user/libexif/CVE-2019-9278.patch | 85 ---------------------------- 5 files changed, 12 insertions(+), 304 deletions(-) delete mode 100644 user/libexif/CVE-2016-6328.patch delete mode 100644 user/libexif/CVE-2017-7544.patch delete mode 100644 user/libexif/CVE-2018-20030.patch delete mode 100644 user/libexif/CVE-2019-9278.patch (limited to 'user') diff --git a/user/libexif/APKBUILD b/user/libexif/APKBUILD index 06e1e832a..8dd3ff715 100644 --- a/user/libexif/APKBUILD +++ b/user/libexif/APKBUILD @@ -1,20 +1,16 @@ # Maintainer: pkgname=libexif -pkgver=0.6.21 -pkgrel=4 +pkgver=0.6.22 +_pkgver=$(printf '%s' "$pkgver" | tr . _) +pkgrel=0 pkgdesc="Library to parse EXIF metadata" -url="https://sourceforge.net/projects/libexif" +url="https://libexif.github.io/" arch="all" license="LGPL-2.0+" subpackages="$pkgname-dev $pkgname-doc $pkgname-lang" depends="" makedepends="" -source="https://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.bz2 - CVE-2016-6328.patch - CVE-2017-7544.patch - CVE-2018-20030.patch - CVE-2019-9278.patch - " +source="https://github.com/libexif/libexif/releases/download/libexif-$_pkgver-release/libexif-$pkgver.tar.xz" # secfixes: # 0.6.21-r3: @@ -23,6 +19,12 @@ source="https://downloads.sourceforge.net/$pkgname/$pkgname-$pkgver.tar.bz2 # 0.6.21-r4: # - CVE-2016-6328 # - CVE-2019-9278 +# 0.6.22-r0: +# - CVE-2020-0093 +# - CVE-2020-12767 +# - CVE-2020-13112 +# - CVE-2020-13113 +# - CVE-2020-13114 prepare() { default_prepare @@ -45,8 +47,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="4e0fe2abe85d1c95b41cb3abe1f6333dc3a9eb69dba106a674a78d74a4d5b9c5a19647118fa1cc2d72b98a29853394f1519eda9e2889eb28d3be26b21c7cfc35 libexif-0.6.21.tar.bz2 -c0d4c74207993efc373615ef2c797d720162a2ee6fd7ad026edf2ced4198d9b1165b88790c2af3194f6bb7c2de88d4672c041c2cff8a82c8914700633332b8c5 CVE-2016-6328.patch -d529c6c5bd26dc21c0946702574184e1f61c2bfd4fb95b41e314f486a0dd55571963ff2cad566d2fb0804de3c0799bcd956c15a3dc10a520ce207728edad4e2d CVE-2017-7544.patch -0d6123bd275ace338ad9cebb31a2e714de0141b91860f07394b281686a5393566c3f4159679d4ba689ae7ea69ae2e412b158c3deb451c40c210b5817f6888bbc CVE-2018-20030.patch -c30c03fefea94d175b94c9f0c4d60cbb3aa0ad78b0d29008975fbbb15c17f2907a16fd50970e5fa18d533d0ce291a5ee9b62934210cb40b0f463693460607738 CVE-2019-9278.patch" +sha512sums="0a9e7bf0258ed98a794b667d45e8fc65299101a2a2d2e39c358715b20b003beff258782f0736cd5b53978428a2f878a989f303bee249a978850a065f33c534af libexif-0.6.22.tar.xz" diff --git a/user/libexif/CVE-2016-6328.patch b/user/libexif/CVE-2016-6328.patch deleted file mode 100644 index 0568f27d2..000000000 --- a/user/libexif/CVE-2016-6328.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 41bd04234b104312f54d25822f68738ba8d7133d Mon Sep 17 00:00:00 2001 -From: Marcus Meissner -Date: Tue, 25 Jul 2017 23:44:44 +0200 -Subject: [PATCH] fixes some (not all) buffer overreads during decoding pentax - makernote entries. - -This should fix: -https://sourceforge.net/p/libexif/bugs/125/ CVE-2016-6328 ---- - libexif/pentax/mnote-pentax-entry.c | 16 +++++++++++++--- - 1 file changed, 13 insertions(+), 3 deletions(-) - -diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c -index d03d159..ea0429a 100644 ---- a/libexif/pentax/mnote-pentax-entry.c -+++ b/libexif/pentax/mnote-pentax-entry.c -@@ -425,24 +425,34 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, - case EXIF_FORMAT_SHORT: - { - const unsigned char *data = entry->data; -- size_t k, len = strlen(val); -+ size_t k, len = strlen(val), sizeleft; -+ -+ sizeleft = entry->size; - for(k=0; kcomponents; k++) { -+ if (sizeleft < 2) -+ break; - vs = exif_get_short (data, entry->order); - snprintf (val+len, maxlen-len, "%i ", vs); - len = strlen(val); - data += 2; -+ sizeleft -= 2; - } - } - break; - case EXIF_FORMAT_LONG: - { - const unsigned char *data = entry->data; -- size_t k, len = strlen(val); -+ size_t k, len = strlen(val), sizeleft; -+ -+ sizeleft = entry->size; - for(k=0; kcomponents; k++) { -+ if (sizeleft < 4) -+ break; - vl = exif_get_long (data, entry->order); - snprintf (val+len, maxlen-len, "%li", (long int) vl); - len = strlen(val); - data += 4; -+ sizeleft -= 4; - } - } - break; -@@ -455,5 +465,5 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, - break; - } - -- return (val); -+ return val; - } diff --git a/user/libexif/CVE-2017-7544.patch b/user/libexif/CVE-2017-7544.patch deleted file mode 100644 index 534817417..000000000 --- a/user/libexif/CVE-2017-7544.patch +++ /dev/null @@ -1,30 +0,0 @@ -From c39acd1692023b26290778a02a9232c873f9d71a Mon Sep 17 00:00:00 2001 -From: Marcus Meissner -Date: Tue, 25 Jul 2017 23:38:56 +0200 -Subject: [PATCH] On saving makernotes, make sure the makernote container tags - has a type with 1 byte components. - -Fixes (at least): - https://sourceforge.net/p/libexif/bugs/130 - https://sourceforge.net/p/libexif/bugs/129 ---- - libexif/exif-data.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/libexif/exif-data.c b/libexif/exif-data.c -index 67df4db..91f4c33 100644 ---- a/libexif/exif-data.c -+++ b/libexif/exif-data.c -@@ -255,6 +255,12 @@ exif_data_save_data_entry (ExifData *data, ExifEntry *e, - exif_mnote_data_set_offset (data->priv->md, *ds - 6); - exif_mnote_data_save (data->priv->md, &e->data, &e->size); - e->components = e->size; -+ if (exif_format_get_size (e->format) != 1) { -+ /* e->format is taken from input code, -+ * but we need to make sure it is a 1 byte -+ * entity due to the multiplication below. */ -+ e->format = EXIF_FORMAT_UNDEFINED; -+ } - } - } - diff --git a/user/libexif/CVE-2018-20030.patch b/user/libexif/CVE-2018-20030.patch deleted file mode 100644 index 837d003d7..000000000 --- a/user/libexif/CVE-2018-20030.patch +++ /dev/null @@ -1,115 +0,0 @@ -Edited slightly to backport to stable - -From 6aa11df549114ebda520dde4cdaea2f9357b2c89 Mon Sep 17 00:00:00 2001 -From: Dan Fandrich -Date: Fri, 12 Oct 2018 16:01:45 +0200 -Subject: [PATCH] Improve deep recursion detection in - exif_data_load_data_content. - -The existing detection was still vulnerable to pathological cases -causing DoS by wasting CPU. The new algorithm takes the number of tags -into account to make it harder to abuse by cases using shallow recursion -but with a very large number of tags. This improves on commit 5d28011c -which wasn't sufficient to counter this kind of case. - -The limitation in the previous fix was discovered by Laurent Delosieres, -Secunia Research at Flexera (Secunia Advisory SA84652) and is assigned -the identifier CVE-2018-20030. ---- - libexif/exif-data.c | 45 +++++++++++++++++++++++++++++++++++++-------- - -diff --git a/libexif/exif-data.c b/libexif/exif-data.c -index e35403d..a6f9c94 100644 ---- a/libexif/exif-data.c -+++ b/libexif/exif-data.c -@@ -35,6 +35,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -350,6 +351,20 @@ if (data->ifd[(i)]->count) { \ - break; \ - } - -+/*! Calculate the recursion cost added by one level of IFD loading. -+ * -+ * The work performed is related to the cost in the exponential relation -+ * work=1.1**cost -+ */ -+static unsigned int -+level_cost(unsigned int n) -+{ -+ static const double log_1_1 = 0.09531017980432493; -+ -+ /* Adding 0.1 protects against the case where n==1 */ -+ return ceil(log(n + 0.1)/log_1_1); -+} -+ - /*! Load data for an IFD. - * - * \param[in,out] data #ExifData -@@ -357,13 +372,13 @@ if (data->ifd[(i)]->count) { \ - * \param[in] d pointer to buffer containing raw IFD data - * \param[in] ds size of raw data in buffer at \c d - * \param[in] offset offset into buffer at \c d at which IFD starts -- * \param[in] recursion_depth number of times this function has been -- * recursively called without returning -+ * \param[in] recursion_cost factor indicating how expensive this recursive -+ * call could be - */ - static void - exif_data_load_data_content (ExifData *data, ExifIfd ifd, - const unsigned char *d, -- unsigned int ds, unsigned int offset, unsigned int recursion_depth) -+ unsigned int ds, unsigned int offset, unsigned int recursion_cost) - { - ExifLong o, thumbnail_offset = 0, thumbnail_length = 0; - ExifShort n; -@@ -378,9 +393,20 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, - if ((((int)ifd) < 0) || ( ((int)ifd) >= EXIF_IFD_COUNT)) - return; - -- if (recursion_depth > 30) { -+ if (recursion_cost > 170) { -+ /* -+ * recursion_cost is a logarithmic-scale indicator of how expensive this -+ * recursive call might end up being. It is an indicator of the depth of -+ * recursion as well as the potential for worst-case future recursive -+ * calls. Since it's difficult to tell ahead of time how often recursion -+ * will occur, this assumes the worst by assuming every tag could end up -+ * causing recursion. -+ * The value of 170 was chosen to limit typical EXIF structures to a -+ * recursive depth of about 6, but pathological ones (those with very -+ * many tags) to only 2. -+ */ - exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", -- "Deep recursion detected!"); -+ "Deep/expensive recursion detected!"); - return; - } - -@@ -422,15 +448,18 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, - switch (tag) { - case EXIF_TAG_EXIF_IFD_POINTER: - CHECK_REC (EXIF_IFD_EXIF); -- exif_data_load_data_content (data, EXIF_IFD_EXIF, d, ds, o, recursion_depth + 1); -+ exif_data_load_data_content (data, EXIF_IFD_EXIF, d, ds, o, -+ recursion_cost + level_cost(n)); - break; - case EXIF_TAG_GPS_INFO_IFD_POINTER: - CHECK_REC (EXIF_IFD_GPS); -- exif_data_load_data_content (data, EXIF_IFD_GPS, d, ds, o, recursion_depth + 1); -+ exif_data_load_data_content (data, EXIF_IFD_GPS, d, ds, o, -+ recursion_cost + level_cost(n)); - break; - case EXIF_TAG_INTEROPERABILITY_IFD_POINTER: - CHECK_REC (EXIF_IFD_INTEROPERABILITY); -- exif_data_load_data_content (data, EXIF_IFD_INTEROPERABILITY, d, ds, o, recursion_depth + 1); -+ exif_data_load_data_content (data, EXIF_IFD_INTEROPERABILITY, d, ds, o, -+ recursion_cost + level_cost(n)); - break; - case EXIF_TAG_JPEG_INTERCHANGE_FORMAT: - thumbnail_offset = o; diff --git a/user/libexif/CVE-2019-9278.patch b/user/libexif/CVE-2019-9278.patch deleted file mode 100644 index bd15e8d13..000000000 --- a/user/libexif/CVE-2019-9278.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 75aa73267fdb1e0ebfbc00369e7312bac43d0566 Mon Sep 17 00:00:00 2001 -From: Marcus Meissner -Date: Sat, 18 Jan 2020 09:29:42 +0100 -Subject: [PATCH] fix CVE-2019-9278 - -avoid the use of unsafe integer overflow checking constructs (unsigned integer operations cannot overflow, so "u1 + u2 > u1" can be optimized away) - -check for the actual sizes, which should also handle the overflows -document other places google patched, but do not seem relevant due to other restrictions - -fixes https://github.com/libexif/libexif/issues/26 ---- - libexif/exif-data.c | 28 ++++++++++++++++++---------- - 1 file changed, 18 insertions(+), 10 deletions(-) - -diff --git a/libexif/exif-data.c b/libexif/exif-data.c -index a6f9c94..6332cd1 100644 ---- a/libexif/exif-data.c -+++ b/libexif/exif-data.c -@@ -192,9 +192,15 @@ exif_data_load_data_entry (ExifData *data, ExifEntry *entry, - doff = offset + 8; - - /* Sanity checks */ -- if ((doff + s < doff) || (doff + s < s) || (doff + s > size)) { -+ if (doff >= size) { - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", -- "Tag data past end of buffer (%u > %u)", doff+s, size); -+ "Tag starts past end of buffer (%u > %u)", doff, size); -+ return 0; -+ } -+ -+ if (s > size - doff) { -+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", -+ "Tag data goes past end of buffer (%u > %u)", doff+s, size); - return 0; - } - -@@ -315,13 +321,14 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, - unsigned int ds, ExifLong o, ExifLong s) - { - /* Sanity checks */ -- if ((o + s < o) || (o + s < s) || (o + s > ds) || (o > ds)) { -- exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", -- "Bogus thumbnail offset (%u) or size (%u).", -- o, s); -+ if (o >= ds) { -+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); -+ return; -+ } -+ if (s > ds - o) { -+ exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); - return; - } -- - if (data->data) - exif_mem_free (data->priv->mem, data->data); - if (!(data->data = exif_data_alloc (data, s))) { -@@ -947,7 +954,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "IFD 0 at %i.", (int) offset); - -- /* Sanity check the offset, being careful about overflow */ -+ /* ds is restricted to 16 bit above, so offset is restricted too, and offset+8 should not overflow. */ - if (offset > ds || offset + 6 + 2 > ds) - return; - -@@ -956,6 +963,7 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, - - /* IFD 1 offset */ - n = exif_get_short (d + 6 + offset, data->priv->order); -+ /* offset < 2<<16, n is 16 bit at most, so this op will not overflow */ - if (offset + 6 + 2 + 12 * n + 4 > ds) - return; - -@@ -964,8 +972,8 @@ exif_data_load_data (ExifData *data, const unsigned char *d_orig, - exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", - "IFD 1 at %i.", (int) offset); - -- /* Sanity check. */ -- if (offset > ds || offset + 6 > ds) { -+ /* Sanity check. ds is ensured to be above 6 above, offset is 16bit */ -+ if (offset > ds - 6) { - exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, - "ExifData", "Bogus offset of IFD1."); - } else { -- cgit v1.2.3-60-g2f50 From 985b73b871df35bfb163c3a180691ac7b8aa55bd Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 12:13:22 -0500 Subject: user/libjpeg-turbo: [CVE] patch CVE-2020-13790 (#298) --- user/libjpeg-turbo/APKBUILD | 11 ++++++++--- user/libjpeg-turbo/CVE-2020-13790.patch | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 3 deletions(-) create mode 100644 user/libjpeg-turbo/CVE-2020-13790.patch (limited to 'user') diff --git a/user/libjpeg-turbo/APKBUILD b/user/libjpeg-turbo/APKBUILD index ad4a4076a..00b4ec314 100644 --- a/user/libjpeg-turbo/APKBUILD +++ b/user/libjpeg-turbo/APKBUILD @@ -2,7 +2,7 @@ # Maintainer: A. Wilcox pkgname=libjpeg-turbo pkgver=2.0.4 -pkgrel=0 +pkgrel=1 pkgdesc="Accelerated JPEG compression and decompression library" url="https://libjpeg-turbo.org/" arch="all" @@ -10,7 +10,9 @@ license="IJG AND BSD-3-Clause AND Zlib" depends="" makedepends="cmake" subpackages="$pkgname-doc $pkgname-dev $pkgname-utils" -source="https://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-$pkgver.tar.gz" +source="https://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-$pkgver.tar.gz + CVE-2020-13790.patch + " case "$CTARGET_ARCH" in pmmx | x86 | x86_64) makedepends="$makedepends nasm" ;; @@ -19,6 +21,8 @@ esac # secfixes: # 2.0.3-r0: # - CVE-2019-2201 +# 2.0.4-r1: +# - CVE-2020-13790 build() { if [ "$CBUILD" != "$CHOST" ]; then @@ -51,4 +55,5 @@ utils() { mv "$pkgdir"/usr/bin "$subpkgdir"/usr/ } -sha512sums="708c2e7418d9ed5abca313e2ff5a08f8176d79cad2127573cda6036583c201973db4cfb0eafc0fc8f57ecc7b000d2b4af95980de54de5a0aed45969e993a5bf9 libjpeg-turbo-2.0.4.tar.gz" +sha512sums="708c2e7418d9ed5abca313e2ff5a08f8176d79cad2127573cda6036583c201973db4cfb0eafc0fc8f57ecc7b000d2b4af95980de54de5a0aed45969e993a5bf9 libjpeg-turbo-2.0.4.tar.gz +83752558d0cf60508a9ccd55505b91f4faa22277537916629a045b2aaa0cb3649e2f90b0df26d389687dc4aba78bdf76e64fc5e5eb324a65026ec86cd95dbe6a CVE-2020-13790.patch" diff --git a/user/libjpeg-turbo/CVE-2020-13790.patch b/user/libjpeg-turbo/CVE-2020-13790.patch new file mode 100644 index 000000000..aaeec0c9c --- /dev/null +++ b/user/libjpeg-turbo/CVE-2020-13790.patch @@ -0,0 +1,35 @@ +From 3de15e0c344d11d4b90f4a47136467053eb2d09a Mon Sep 17 00:00:00 2001 +From: DRC +Date: Tue, 2 Jun 2020 14:15:37 -0500 +Subject: [PATCH] rdppm.c: Fix buf overrun caused by bad binary PPM + +This extends the fix in 1e81b0c3ea26f4ea8f56de05367469333de64a9f to +include binary PPM files with maximum values < 255, thus preventing a +malformed binary PPM input file with those specifications from +triggering an overrun of the rescale array and potentially crashing +cjpeg, TJBench, or any program that uses the tjLoadImage() function. + +Fixes #433 + +diff --git a/rdppm.c b/rdppm.c +index 87bc33090..a8507b902 100644 +--- a/rdppm.c ++++ b/rdppm.c +@@ -5,7 +5,7 @@ + * Copyright (C) 1991-1997, Thomas G. Lane. + * Modified 2009 by Bill Allombert, Guido Vollbeding. + * libjpeg-turbo Modifications: +- * Copyright (C) 2015-2017, D. R. Commander. ++ * Copyright (C) 2015-2017, 2020, D. R. Commander. + * For conditions of distribution and use, see the accompanying README.ijg + * file. + * +@@ -720,7 +720,7 @@ start_input_ppm(j_compress_ptr cinfo, cjpeg_source_ptr sinfo) + /* On 16-bit-int machines we have to be careful of maxval = 65535 */ + source->rescale = (JSAMPLE *) + (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE, +- (size_t)(((long)maxval + 1L) * ++ (size_t)(((long)MAX(maxval, 255) + 1L) * + sizeof(JSAMPLE))); + half_maxval = maxval / 2; + for (val = 0; val <= (long)maxval; val++) { -- cgit v1.2.3-60-g2f50 From 63cfe0e15c2aad8faf44f11e508fa0d271e00bfa Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 12:44:23 -0500 Subject: user/openldap: [CVE] bump to 2.4.50 (#275) --- user/openldap/APKBUILD | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'user') diff --git a/user/openldap/APKBUILD b/user/openldap/APKBUILD index 30f2059ff..1743a4e6d 100644 --- a/user/openldap/APKBUILD +++ b/user/openldap/APKBUILD @@ -1,6 +1,8 @@ # Maintainer: A. Wilcox # # secfixes: +# 2.4.50-r0: +# - CVE-2020-12243 # 2.4.48-r0: # - CVE-2019-13057 # - CVE-2019-13565 @@ -11,7 +13,7 @@ # - CVE-2017-9287 # pkgname=openldap -pkgver=2.4.49 +pkgver=2.4.50 pkgrel=0 pkgdesc="LDAP Server" url="https://www.openldap.org/" @@ -29,7 +31,7 @@ subpackages="$pkgname-dev $pkgname-doc libldap $pkgname-openrc pkgusers="ldap" pkggroups="ldap" install="$pkgname.pre-install $pkgname.post-install $pkgname.post-upgrade" -source="ftp://ftp.$pkgname.org/pub/OpenLDAP/$pkgname-release/$pkgname-$pkgver.tgz +source="https://www.$pkgname.org/software/download/OpenLDAP/$pkgname-release/$pkgname-$pkgver.tgz openldap-2.4-ppolicy.patch openldap-2.4.11-libldap_r.patch fix-manpages.patch @@ -60,7 +62,6 @@ done prepare() { default_prepare - update_config_sub sed -i '/^STRIP/s,-s,,g' build/top.mk libtoolize --force && aclocal && autoconf @@ -198,7 +199,7 @@ _submv() { done } -sha512sums="99d1943d126b06e62865e31e5825fcff2cb15415f7f85ae4962fa0e7425bc3b58db5b9639150d7b09e3642c80257724c745e47c25ab4fcb1bba0ba771011dd49 openldap-2.4.49.tgz +sha512sums="f528043ff9de36f7b65d8816c9a9c24f0ac400041b2969965178ee6eae62c92a11af33a0a883e4954e5fff98a0738a9f9aa2faf5b385d21974754e045aab31ae openldap-2.4.50.tgz 5d34d49eabe7cb66cf8284cc3bd9730fa23df4932df68549e242d250ee50d40c434ae074ebc720d5fbcd9d16587c9333c5598d30a5f1177caa61461ab7771f38 openldap-2.4-ppolicy.patch 44d97efb25d4f39ab10cd5571db43f3bfa7c617a5bb087085ae16c0298aca899b55c8742a502121ba743a73e6d77cd2056bc96cee63d6d0862dabc8fb5574357 openldap-2.4.11-libldap_r.patch 8c4244d316a05870dd1147b2ab7ddbcfd7626b5dce2f5a0e72f066dc635c2edb4f1ea3be88c6fec2d5ab016001be16bedef70f2ce0695c3cd96f69e1614ff177 fix-manpages.patch -- cgit v1.2.3-60-g2f50 From 6712fde0b877ac8ae5c3cd3051215db1c7f366c5 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 13:25:44 -0500 Subject: user/py3-pyyaml: [CVE] bump to 5.3.1 (#251) --- user/py3-pyyaml/APKBUILD | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'user') diff --git a/user/py3-pyyaml/APKBUILD b/user/py3-pyyaml/APKBUILD index e2ce44251..afbf6f336 100644 --- a/user/py3-pyyaml/APKBUILD +++ b/user/py3-pyyaml/APKBUILD @@ -2,11 +2,12 @@ # Maintainer: pkgname=py3-pyyaml _pkgname=pyyaml -pkgver=5.1.2 +pkgver=5.3.1 pkgrel=0 pkgdesc="YAML parser and emitter for Python" url="https://pyyaml.org/wiki/PyYAML" arch="noarch" +# Certified net clean license="MIT" depends="python3 yaml" makedepends="python3-dev yaml yaml-dev" @@ -14,6 +15,10 @@ subpackages="" source="$pkgname-$pkgver.tar.gz::https://github.com/yaml/$_pkgname/archive/$pkgver.tar.gz" builddir="$srcdir/$_pkgname-$pkgver" +# secfixes: +# 5.3.1-r0: +# - CVE-2020-1747 + build() { # Seems like they need Cython to build the C extension now, so it falls back to pure Python. # Once we ship Cython we can probably change this. @@ -28,4 +33,4 @@ package() { python3 setup.py install --prefix=/usr --root="$pkgdir" } -sha512sums="7bc3dceadcfd512ede67581625887d00822464f20d3b646904f4a73afce8cf3b9766829c6004b626c31757edf8e2eedc27e60d96bee13afa68d3296a8a7f33bb py3-pyyaml-5.1.2.tar.gz" +sha512sums="27d97e8493c7660c7c0c471e20a8aa46c85431e4559a98bcbdafc2bd89a67fd04c6f2090e54ff6b206c868b33635ef8be68070a4c25d17a25c97fd5ad3549556 py3-pyyaml-5.3.1.tar.gz" -- cgit v1.2.3-60-g2f50 From acd0f32c20a3f312ae45c4431200a3734a2269b8 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 14:25:32 -0500 Subject: user/dbus: [CVE] bump to 1.12.18 (#295) --- user/dbus/APKBUILD | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'user') diff --git a/user/dbus/APKBUILD b/user/dbus/APKBUILD index d9a305186..4ff57480f 100644 --- a/user/dbus/APKBUILD +++ b/user/dbus/APKBUILD @@ -1,9 +1,9 @@ # Maintainer: A. Wilcox pkgname=dbus -pkgver=1.12.16 -pkgrel=1 +pkgver=1.12.18 +pkgrel=0 pkgdesc="IPC/message bus system, allowing user applications to communicate" -url="http://www.freedesktop.org/wiki/Software/dbus/" +url="https://www.freedesktop.org/wiki/Software/dbus/" pkggroups="messagebus" pkgusers="messagebus" arch="all" @@ -23,7 +23,9 @@ source="http://dbus.freedesktop.org/releases/dbus/dbus-$pkgver.tar.gz # secfixes: # 1.12.16-r0: -# - CVE-2019-12749 +# - CVE-2019-12749 +# 1.12.18-r0: +# - CVE-2020-12049 build() { ./configure \ @@ -65,5 +67,5 @@ x11() { mv "$pkgdir"/usr/bin/dbus-launch "$subpkgdir"/usr/bin/ } -sha512sums="27ae805170e9515a8bb0fba5f29d414edc70e3b6b28b7b65bbea47035b8eafa9ac4820cdc92645be6035f6748f8aa45679e1ffc84ba74a64859a3056d318b9bb dbus-1.12.16.tar.gz +sha512sums="817674e86a5d4cbfa705a79ca5197176311e47505c5da02334c2811f63b55014b582a12bce53bc73a08a3ad5061f210ba0d1e5f3bbf7697c81ca70c22a76fc13 dbus-1.12.18.tar.gz df74e7d6a4f76f777d356e94bd23422b17656aa51a5b2d3c655fcabb32c84f2f06b9f5cd8827920d51842f89e8c0d968a6e723315e4bf216e55711fcda9b0ee9 dbus.initd" -- cgit v1.2.3-60-g2f50 From e06ce962717e9524f5bb68880bca3ecfe3c47647 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Wed, 10 Jun 2020 14:54:20 -0500 Subject: user/nghttp2: [CVE] bump to 1.41.0 (#299), disable no-op check() --- user/nghttp2/APKBUILD | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'user') diff --git a/user/nghttp2/APKBUILD b/user/nghttp2/APKBUILD index 41dd0bc58..063bc9b0f 100644 --- a/user/nghttp2/APKBUILD +++ b/user/nghttp2/APKBUILD @@ -1,17 +1,22 @@ # Contributor: Natanael Copa # Maintainer: pkgname=nghttp2 -pkgver=1.40.0 +pkgver=1.41.0 pkgrel=0 pkgdesc="Experimental HTTP/2 client, server and proxy" url="https://nghttp2.org/" arch="all" +options="!check" # Requires cunit, which we don't currently ship license="MIT" depends="" makedepends="c-ares-dev libev-dev libxml2-dev openssl-dev zlib-dev" subpackages="$pkgname-dev $pkgname-doc $pkgname-libs" source="https://github.com/tatsuhiro-t/$pkgname/releases/download/v$pkgver/nghttp2-$pkgver.tar.xz" +# secfixes: +# 1.41.0-r0: +# - CVE-2020-11080 + build() { ./configure \ --build=$CBUILD \ @@ -37,4 +42,4 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="3f9b989c4bd9571b11bb9d59fe2dfd5596ba3962babfc836587d5047e780400a6cf46e43c602caa25ca83c03b84a1629953140d45223099b193df54a719745ce nghttp2-1.40.0.tar.xz" +sha512sums="c92e8022ccc876fa311f21bc5bf5af75feff8232efb56a4b2ab198031e974d15b67c16c046188cc76552f75a1b2e7115925d6ce1e42d6f94ae482fe69727466d nghttp2-1.41.0.tar.xz" -- cgit v1.2.3-60-g2f50 From 8c8498bd45cbacc5d0436c9ac5cdd64b3d960405 Mon Sep 17 00:00:00 2001 From: Max Rees Date: Fri, 12 Jun 2020 19:30:07 -0500 Subject: user/libjpeg-turbo: set -DFLOATTEST=64bit for ppc --- user/libjpeg-turbo/APKBUILD | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'user') diff --git a/user/libjpeg-turbo/APKBUILD b/user/libjpeg-turbo/APKBUILD index 00b4ec314..cbecdd1a4 100644 --- a/user/libjpeg-turbo/APKBUILD +++ b/user/libjpeg-turbo/APKBUILD @@ -28,6 +28,13 @@ build() { if [ "$CBUILD" != "$CHOST" ]; then CMAKE_CROSSOPTS="-DCMAKE_SYSTEM_NAME=Linux -DCMAKE_HOST_SYSTEM_NAME=Linux" fi + + # https://github.com/libjpeg-turbo/libjpeg-turbo/issues/344 + # https://github.com/libjpeg-turbo/libjpeg-turbo/issues/428 + case "$CARCH" in + ppc) _floattest=64bit;; + esac + cmake \ -DCMAKE_INSTALL_PREFIX=/usr \ -DCMAKE_INSTALL_DEFAULT_LIBDIR=lib \ @@ -36,6 +43,7 @@ build() { -DCMAKE_C_FLAGS="$CFLAGS" \ -DENABLE_STATIC=OFF \ -DWITH_JPEG8=ON \ + ${_floattest:+-DFLOATTEST="$_floattest"} \ ${CMAKE_CROSSOPTS} . make } -- cgit v1.2.3-60-g2f50 From 29e941e719283d2570dc67038722d6ea6c19874e Mon Sep 17 00:00:00 2001 From: Max Rees Date: Mon, 15 Jun 2020 15:25:50 -0500 Subject: user/libexif: patch CVE-2020-0198 (#285) --- user/libexif/APKBUILD | 9 +++++-- user/libexif/CVE-2020-0198.patch | 58 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+), 2 deletions(-) create mode 100644 user/libexif/CVE-2020-0198.patch (limited to 'user') diff --git a/user/libexif/APKBUILD b/user/libexif/APKBUILD index 8dd3ff715..320b87492 100644 --- a/user/libexif/APKBUILD +++ b/user/libexif/APKBUILD @@ -10,7 +10,9 @@ license="LGPL-2.0+" subpackages="$pkgname-dev $pkgname-doc $pkgname-lang" depends="" makedepends="" -source="https://github.com/libexif/libexif/releases/download/libexif-$_pkgver-release/libexif-$pkgver.tar.xz" +source="https://github.com/libexif/libexif/releases/download/libexif-$_pkgver-release/libexif-$pkgver.tar.xz + CVE-2020-0198.patch + " # secfixes: # 0.6.21-r3: @@ -21,6 +23,8 @@ source="https://github.com/libexif/libexif/releases/download/libexif-$_pkgver-re # - CVE-2019-9278 # 0.6.22-r0: # - CVE-2020-0093 +# - CVE-2020-0182 +# - CVE-2020-0198 # - CVE-2020-12767 # - CVE-2020-13112 # - CVE-2020-13113 @@ -47,4 +51,5 @@ package() { make DESTDIR="$pkgdir" install } -sha512sums="0a9e7bf0258ed98a794b667d45e8fc65299101a2a2d2e39c358715b20b003beff258782f0736cd5b53978428a2f878a989f303bee249a978850a065f33c534af libexif-0.6.22.tar.xz" +sha512sums="0a9e7bf0258ed98a794b667d45e8fc65299101a2a2d2e39c358715b20b003beff258782f0736cd5b53978428a2f878a989f303bee249a978850a065f33c534af libexif-0.6.22.tar.xz +7df084f9acdc09bd05fadfb66332956d8587fcaac9d693000f47fadeba17b3c49eafa402d1e2c9b7d394e697feccd1f760bab8b64378deaea1777c5a3b90c3b2 CVE-2020-0198.patch" diff --git a/user/libexif/CVE-2020-0198.patch b/user/libexif/CVE-2020-0198.patch new file mode 100644 index 000000000..e0358c220 --- /dev/null +++ b/user/libexif/CVE-2020-0198.patch @@ -0,0 +1,58 @@ +From ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c Mon Sep 17 00:00:00 2001 +From: Marcus Meissner +Date: Mon, 8 Jun 2020 17:27:06 +0200 +Subject: [PATCH] fixed another unsigned integer overflow + +first fixed by google in android fork, +https://android.googlesource.com/platform/external/libexif/+/1e187b62682ffab5003c702657d6d725b4278f16%5E%21/#F0 + +(use a more generic overflow check method, also check second overflow instance.) + +https://security-tracker.debian.org/tracker/CVE-2020-0198 +--- + libexif/exif-data.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/libexif/exif-data.c b/libexif/exif-data.c +index 8b280d3..b495726 100644 +--- a/libexif/exif-data.c ++++ b/libexif/exif-data.c +@@ -47,6 +47,8 @@ + #undef JPEG_MARKER_APP1 + #define JPEG_MARKER_APP1 0xe1 + ++#define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize )) ++ + static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00}; + + struct _ExifDataPrivate +@@ -327,7 +329,7 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d, + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o); + return; + } +- if (s > ds - o) { ++ if (CHECKOVERFLOW(o,ds,s)) { + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o); + return; + } +@@ -420,9 +422,9 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + } + + /* Read the number of entries */ +- if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) { ++ if (CHECKOVERFLOW(offset, ds, 2)) { + exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData", +- "Tag data past end of buffer (%u > %u)", offset+2, ds); ++ "Tag data past end of buffer (%u+2 > %u)", offset, ds); + return; + } + n = exif_get_short (d + offset, data->priv->order); +@@ -431,7 +433,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd, + offset += 2; + + /* Check if we have enough data. */ +- if (offset + 12 * n > ds) { ++ if (CHECKOVERFLOW(offset, ds, 12*n)) { + n = (ds - offset) / 12; + exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", + "Short data; only loading %hu entries...", n); -- cgit v1.2.3-60-g2f50