Files
buildroot/package
Fabrice Fontaine ec17cfab3d package/lrzip: security bump to 8781292dd5833c04eeead51d4a5bd02dc6432dc7
Bump to latest upstream commit as it fixes a huge number of CVEs. Some
of them can't be linked to a given commit (e.g.
https://github.com/ckolivas/lrzip/issues/67). Moreover, upstream does
not plan to tag a new release any time soon:
https://github.com/ckolivas/lrzip/issues/99

- Fix CVE-2017-8842: The bufRead::get() function in libzpaq/libzpaq.h in
  liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial
  of service (divide-by-zero error and application crash) via a crafted
  archive.
- Fix CVE-2017-8843: The join_pthread function in stream.c in
  liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial
  of service (NULL pointer dereference and application crash) via a
  crafted archive.
- Fix CVE-2017-8844: The read_1g function in stream.c in liblrzip.so in
  lrzip 0.631 allows remote attackers to cause a denial of service
  (heap-based buffer overflow and application crash) or possibly have
  unspecified other impact via a crafted archive.
- Fix CVE-2017-8845: The lzo1x_decompress function in lzo1x_d.ch in LZO
  2.08, as used in lrzip 0.631, allows remote attackers to cause a
  denial of service (invalid memory read and application crash) via a
  crafted archive.
- Fix CVE-2017-8846: The read_stream function in stream.c in
  liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial
  of service (use-after-free and application crash) via a crafted
  archive.
- Fix CVE-2017-8847: The bufRead::get() function in libzpaq/libzpaq.h in
  liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial
  of service (NULL pointer dereference and application crash) via a
  crafted archive.
- Fix CVE-2017-9928: In lrzip 0.631, a stack buffer overflow was found
  in the function get_fileinfo in lrzip.c:979, which allows attackers to
  cause a denial of service via a crafted file.
- Fix CVE-2017-9929: In lrzip 0.631, a stack buffer overflow was found
  in the function get_fileinfo in lrzip.c:1074, which allows attackers
  to cause a denial of service via a crafted file.
- Fix CVE-2018-5747: In Long Range Zip (aka lrzip) 0.631, there is a
  use-after-free in the ucompthread function (stream.c). Remote
  attackers could leverage this vulnerability to cause a denial of
  service via a crafted lrz file.
- Fix CVE-2018-11496: In Long Range Zip (aka lrzip) 0.631, there is a
  use-after-free in read_stream in stream.c, because decompress_file in
  lrzip.c lacks certain size validation.

Also:
 - update indentation of hash file (two spaces)
 - drop patch (already in version)
 - manage host-nasm dependency which is enabled by default and has been
   fixed by:
   9f16f65705

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0f783ba66e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-26 11:22:16 +02:00
..
2020-02-25 23:24:34 +01:00
2020-02-23 09:45:10 +01:00
2020-02-03 14:44:52 +01:00
2019-12-31 09:31:56 +01:00
2020-01-28 23:20:40 +01:00
2020-02-03 14:44:52 +01:00
2020-04-25 09:06:09 +02:00
2020-02-29 23:17:29 +01:00
2019-12-24 14:06:48 +01:00
2019-12-25 22:46:39 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-29 19:26:38 +01:00
2020-05-10 22:39:00 +02:00
2019-12-25 22:06:25 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-05 15:37:51 +01:00
2020-02-03 14:44:52 +01:00
2020-02-19 20:56:01 +01:00
2020-02-03 14:44:52 +01:00
2020-05-08 11:39:03 +02:00
2020-05-10 21:24:53 +02:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-05-10 22:32:45 +02:00
2020-02-03 14:44:52 +01:00
2020-01-11 22:39:56 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-02-03 14:44:52 +01:00
2020-01-13 21:16:14 +01:00
2020-02-03 14:44:53 +01:00
2020-04-25 09:00:02 +02:00
2020-01-01 23:01:27 +01:00
2020-05-08 12:08:05 +02:00
2020-02-03 14:44:53 +01:00
2020-02-03 14:44:53 +01:00
2020-02-15 11:53:19 +01:00
2020-02-03 14:44:53 +01:00
2020-02-03 22:55:08 +01:00
2020-02-11 23:28:26 +01:00
2020-04-07 21:04:41 +02:00
2020-02-03 14:44:53 +01:00
2020-04-07 20:28:05 +02:00
2020-02-03 14:44:53 +01:00
2019-12-30 21:41:36 +01:00
2020-02-03 14:44:53 +01:00
2020-01-19 10:01:11 +01:00
2020-02-03 14:44:53 +01:00
2020-02-03 14:44:53 +01:00
2020-01-13 21:19:46 +01:00
2019-12-22 16:01:00 +01:00
2020-01-08 23:10:11 +01:00
2020-01-08 09:30:56 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 22:55:08 +01:00
2020-01-18 13:44:19 +01:00
2020-04-08 16:15:11 +02:00
2019-12-22 11:07:13 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:21:06 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-02 15:12:05 +01:00
2020-01-12 22:51:08 +01:00
2020-01-12 22:51:57 +01:00
2020-02-03 14:45:35 +01:00
2020-02-23 09:26:10 +01:00
2019-12-26 09:38:54 +01:00
2020-02-03 14:45:35 +01:00
2020-04-08 16:30:36 +02:00
2020-05-08 09:13:34 +02:00
2020-02-03 14:45:35 +01:00
2020-02-03 14:45:35 +01:00
2020-02-15 12:04:49 +01:00
2020-02-03 14:45:35 +01:00
2020-01-20 20:04:12 +01:00
2020-02-03 14:45:35 +01:00
2020-01-19 23:10:05 +01:00
2020-02-03 14:45:35 +01:00
2020-01-08 23:10:09 +01:00
2020-01-05 22:01:58 +01:00
2020-02-15 11:58:38 +01:00
2020-02-03 21:17:54 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 22:55:08 +01:00
2020-04-30 14:42:03 +02:00
2019-12-22 14:10:48 +01:00
2020-01-28 23:23:53 +01:00
2020-02-04 19:36:18 +01:00
2020-02-03 14:45:36 +01:00
2020-04-29 23:49:57 +02:00
2020-02-14 09:13:07 +01:00
2020-03-08 09:41:44 +01:00
2020-02-03 14:45:36 +01:00
2020-01-14 17:14:46 +01:00
2020-01-12 22:11:27 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2019-12-26 20:43:52 +01:00
2020-02-04 22:55:41 +01:00
2020-03-07 22:43:55 +01:00
2019-12-22 11:38:42 +01:00
2020-04-07 20:24:58 +02:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-01-26 12:40:48 +01:00
2020-02-03 14:45:36 +01:00
2020-02-02 00:07:26 +01:00
2020-03-02 23:33:57 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-03-07 22:52:02 +01:00
2020-01-01 11:59:42 +01:00
2019-12-24 14:11:43 +01:00
2020-01-05 22:00:24 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-14 09:13:07 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-04-07 21:02:37 +02:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 15:29:52 +01:00
2020-01-19 23:07:17 +01:00
2020-02-03 14:45:36 +01:00
2020-02-03 14:45:36 +01:00
2020-01-05 21:32:39 +01:00
2020-02-05 20:28:33 +01:00
2020-02-03 14:45:37 +01:00
2020-02-03 14:45:37 +01:00
2020-05-09 09:20:45 +02:00
2019-12-22 13:52:25 +01:00
2020-02-03 14:45:37 +01:00
2020-03-03 23:49:49 +01:00