mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libarchive: security bump to version 3.7.6

Browse Source 
3.7.5 fixed a number of security issues:

    fix multiple vulnerabilities identified by SAST (#2251, #2256)
    cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing (#2258)
    lzop: prevent integer overflow (#2174)
    rar4: protect copy_from_lzss_window_to_unp() (#2172, CVE-2024-20696)
    rar4: fix CVE-2024-26256 (#2269, CVS-2024-26256)
    rar4: fix OOB in delta and audio filter (#2148, #2149)
    rar4: fix out of boundary access with large files (#2179)
    rar4: add boundary checks to rgb filter (#2210)
    rar4: fix OOB access with unicode filenames (#2203)
    rar5: clear 'data ready' cache on window buffer reallocs (#2265)
    rpm: calculate huge header sizes correctly (#2158)
    unzip: unify EOF handling (#2175)
    util: fix out of boundary access in mktemp functions (#2160)
    uu: stop processing if lines are too long (#2168)

And 3.7.6 fixed a tar regression introduced in 3.7.5

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab3c84e5e2)
[Peter: mark as security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Francois Perrad
2024-09-25 15:37:34 +02:00
committed by Peter Korsgaard
parent 3ade4d0bb1
commit 729b66dcbb
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch
View File

@@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac
index 93f7af94..204a4e69 100644
--- a/configure.ac
+++ b/configure.ac
@@ -434,9 +434,7 @@ if test "x$with_iconv" != "xno"; then
@@ -449,9 +449,7 @@ if test "x$with_iconv" != "xno"; then
AC_CHECK_HEADERS([localcharset.h])
am_save_LIBS="$LIBS"
LIBS="${LIBS} ${LIBICONV}"

2
package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch
View File

@@ -17,7 +17,7 @@ diff --git a/configure.ac b/configure.ac
index 99bff20d1..f245d0c55 100644
--- a/configure.ac
+++ b/configure.ac
@@ -434,7 +434,6 @@ if test "x$with_iconv" != "xno"; then
@@ -449,7 +449,6 @@ if test "x$with_iconv" != "xno"; then
AC_CHECK_HEADERS([localcharset.h])
am_save_LIBS="$LIBS"
LIBS="${LIBS} ${LIBICONV}"

2
package/libarchive/libarchive.hash
View File

@@ -1,4 +1,4 @@
# From https://www.libarchive.de/downloads/sha256sums
sha256 f887755c434a736a609cbd28d87ddbfbe9d6a3bb5b703c22c02f6af80a802735 libarchive-3.7.4.tar.xz
sha256 0a2efdcb185da2eb1e7cd8421434cb9a6119f72417a13335cca378d476fd3ba0 libarchive-3.7.6.tar.xz
# Locally computed:
sha256 b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba COPYING

2
package/libarchive/libarchive.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBARCHIVE_VERSION = 3.7.4
LIBARCHIVE_VERSION = 3.7.6
LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz
LIBARCHIVE_SITE = https://www.libarchive.de/downloads
LIBARCHIVE_INSTALL_STAGING = YES