From 729b66dcbbf0d1cc9366734bb70934818bbee748 Mon Sep 17 00:00:00 2001 From: Francois Perrad Date: Wed, 25 Sep 2024 15:37:34 +0200 Subject: [PATCH] package/libarchive: security bump to version 3.7.6 3.7.5 fixed a number of security issues: fix multiple vulnerabilities identified by SAST (#2251, #2256) cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing (#2258) lzop: prevent integer overflow (#2174) rar4: protect copy_from_lzss_window_to_unp() (#2172, CVE-2024-20696) rar4: fix CVE-2024-26256 (#2269, CVS-2024-26256) rar4: fix OOB in delta and audio filter (#2148, #2149) rar4: fix out of boundary access with large files (#2179) rar4: add boundary checks to rgb filter (#2210) rar4: fix OOB access with unicode filenames (#2203) rar5: clear 'data ready' cache on window buffer reallocs (#2265) rpm: calculate huge header sizes correctly (#2158) unzip: unify EOF handling (#2175) util: fix out of boundary access in mktemp functions (#2160) uu: stop processing if lines are too long (#2168) And 3.7.6 fixed a tar regression introduced in 3.7.5 Signed-off-by: Francois Perrad Signed-off-by: Thomas Petazzoni (cherry picked from commit ab3c84e5e2391a7832f6baa2f20b28661f55dd2c) [Peter: mark as security bump] Signed-off-by: Peter Korsgaard --- ...1-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch | 2 +- .../0002-autotools-do-not-add-iconv-for-Requires.private.patch | 2 +- package/libarchive/libarchive.hash | 2 +- package/libarchive/libarchive.mk | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch b/package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch index a4dd7dad5c..e630c51fef 100644 --- a/package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch +++ b/package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch @@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac index 93f7af94..204a4e69 100644 --- a/configure.ac +++ b/configure.ac -@@ -434,9 +434,7 @@ if test "x$with_iconv" != "xno"; then +@@ -449,9 +449,7 @@ if test "x$with_iconv" != "xno"; then AC_CHECK_HEADERS([localcharset.h]) am_save_LIBS="$LIBS" LIBS="${LIBS} ${LIBICONV}" diff --git a/package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch b/package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch index 3cbd304109..aca2dab9db 100644 --- a/package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch +++ b/package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch @@ -17,7 +17,7 @@ diff --git a/configure.ac b/configure.ac index 99bff20d1..f245d0c55 100644 --- a/configure.ac +++ b/configure.ac -@@ -434,7 +434,6 @@ if test "x$with_iconv" != "xno"; then +@@ -449,7 +449,6 @@ if test "x$with_iconv" != "xno"; then AC_CHECK_HEADERS([localcharset.h]) am_save_LIBS="$LIBS" LIBS="${LIBS} ${LIBICONV}" diff --git a/package/libarchive/libarchive.hash b/package/libarchive/libarchive.hash index a2c6488731..08920b61c5 100644 --- a/package/libarchive/libarchive.hash +++ b/package/libarchive/libarchive.hash @@ -1,4 +1,4 @@ # From https://www.libarchive.de/downloads/sha256sums -sha256 f887755c434a736a609cbd28d87ddbfbe9d6a3bb5b703c22c02f6af80a802735 libarchive-3.7.4.tar.xz +sha256 0a2efdcb185da2eb1e7cd8421434cb9a6119f72417a13335cca378d476fd3ba0 libarchive-3.7.6.tar.xz # Locally computed: sha256 b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba COPYING diff --git a/package/libarchive/libarchive.mk b/package/libarchive/libarchive.mk index 7d58b5c69f..d3a447552e 100644 --- a/package/libarchive/libarchive.mk +++ b/package/libarchive/libarchive.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBARCHIVE_VERSION = 3.7.4 +LIBARCHIVE_VERSION = 3.7.6 LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz LIBARCHIVE_SITE = https://www.libarchive.de/downloads LIBARCHIVE_INSTALL_STAGING = YES