From 03b44ac6d6a681e64cef2312187cccbd0b5b7958 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Fri, 6 Oct 2023 08:24:49 +0200 Subject: [PATCH] package/{glibc, localedef}: security bump to version glibc-2.37-45-gb4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 Fixes the following security issues: CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the environment of a setuid program and NAME is valid, it may result in a buffer overflow, which could be exploited to achieve escalated privileges. This flaw was introduced in glibc 2.34. Signed-off-by: Peter Korsgaard --- package/glibc/glibc.hash | 2 +- package/glibc/glibc.mk | 2 +- package/localedef/localedef.mk | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index ab310498b8..2b8f49ea6b 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,5 +1,5 @@ # Locally calculated (fetched from Github) -sha256 7129dfadea29e8f20865186a7fdec3dc3e65d055a81dc8fc399189491bba493c glibc-2.37-43-g94ef70136587c40a357f775677997c753b3de56c.tar.gz +sha256 19d874f03dadbccaca8ae88a0e96d38435066badfe6ed606c2ad1e525454dece glibc-2.37-45-gb4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3.tar.gz # Hashes for license files sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 666d9e4a8c..319028b058 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -7,7 +7,7 @@ # Generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- # When updating the version, please also update localedef -GLIBC_VERSION = 2.37-43-g94ef70136587c40a357f775677997c753b3de56c +GLIBC_VERSION = 2.37-45-gb4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 # Upstream doesn't officially provide an https download link. # There is one (https://sourceware.org/git/glibc.git) but it's not reliable, # sometimes the connection times out. So use an unofficial github mirror. diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk index d368121a1a..18f040d7c2 100644 --- a/package/localedef/localedef.mk +++ b/package/localedef/localedef.mk @@ -7,7 +7,7 @@ # Use the same VERSION and SITE as target glibc # As in glibc.mk, generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- -LOCALEDEF_VERSION = 2.37-43-g94ef70136587c40a357f775677997c753b3de56c +LOCALEDEF_VERSION = 2.37-45-gb4e23c75aea756b4bddc4abcf27a1c6dca8b6bd3 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION)) HOST_LOCALEDEF_DL_SUBDIR = glibc