godotengine/buildroot
1
0
Fork 0
mirror of https://github.com/godotengine/buildroot.git synced 2025-12-31 09:48:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

unrar: security bump to version 5.5.8

Browse Source 
Fixes the following security issues:

CVE-2017-12938 - UnRAR before 5.5.7 allows remote attackers to bypass a
directory-traversal protection mechanism via vectors involving a symlink to
the . directory, a symlink to the .. directory, and a regular file.

CVE-2017-12940 - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read
in the EncodeFileName::Decode call within the Archive::ReadHeader15
function.

CVE-2017-12941 - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read
in the Unpack::Unpack20 function.

CVE-2017-12942 - libunrar.a in UnRAR before 5.5.7 has a buffer overflow in
the Unpack::LongLZ function.

For more details, see
http://www.openwall.com/lists/oss-security/2017/08/14/3

While we're at it, add a hash for the license file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 322599744c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Peter Korsgaard
2017-09-07 18:58:38 +02:00
parent 11374c8797
commit deb560509e
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
package/unrar/unrar.hash
View File

@@ -1,2 +1,3 @@
# Locally computed:
sha256 e470c584332422893fb52e049f2cbd99e24dc6c6da971008b4e2ae4284f8796c unrarsrc-5.4.5.tar.gz
sha256 9b66e4353a9944bc140eb2a919ff99482dd548f858f5e296d809e8f7cdb2fcf4 unrarsrc-5.5.8.tar.gz
sha256 6ecc1687808b7d66b24f874755abfed7464d9751ed0001cd4e8e5d9bf397ff8a license.txt

2
package/unrar/unrar.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
UNRAR_VERSION = 5.4.5
UNRAR_VERSION = 5.5.8
UNRAR_SOURCE = unrarsrc-$(UNRAR_VERSION).tar.gz
UNRAR_SITE = http://www.rarlab.com/rar
UNRAR_LICENSE = unrar