mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 08:30:47 -09:00
4e73a15a7b
The patch is provided thanks to the Ubuntu community.
- CVE-2021-4217:
A flaw was found in unzip. The vulnerability occurs due to improper
handling of Unicode strings, which can lead to a null pointer
dereference. This flaw allows an attacker to input a specially crafted
zip file, leading to a crash or code execution.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-4217
- https://launchpadlibrarian.net/580782282/0001-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
- https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: correct _IGNORE_CVES entry]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
72 lines
2.3 KiB
Makefile
72 lines
2.3 KiB
Makefile
################################################################################
|
|
#
|
|
# unzip
|
|
#
|
|
################################################################################
|
|
|
|
UNZIP_VERSION = 6.0
|
|
UNZIP_SOURCE = unzip_$(UNZIP_VERSION).orig.tar.gz
|
|
UNZIP_SITE = https://snapshot.debian.org/archive/debian/20250311T215724Z/pool/main/u/unzip
|
|
UNZIP_LICENSE = Info-ZIP
|
|
UNZIP_LICENSE_FILES = LICENSE
|
|
UNZIP_CPE_ID_VALID = YES
|
|
|
|
# 0009-cve-2014-8139-crc-overflow.patch
|
|
UNZIP_IGNORE_CVES += CVE-2014-8139
|
|
|
|
# 0010-cve-2014-8140-test-compr-eb.patch
|
|
UNZIP_IGNORE_CVES += CVE-2014-8140
|
|
|
|
# 0011-cve-2014-8141-getzip64data.patch
|
|
UNZIP_IGNORE_CVES += CVE-2014-8141
|
|
|
|
# 0012-cve-2014-9636-test-compr-eb.patch
|
|
UNZIP_IGNORE_CVES += CVE-2014-9636
|
|
|
|
# 0018-cve-2014-9913-unzip-buffer-overflow.patch
|
|
UNZIP_IGNORE_CVES += CVE-2014-9913
|
|
|
|
# 0014-cve-2015-7696.patch
|
|
UNZIP_IGNORE_CVES += CVE-2015-7696
|
|
|
|
# 0015-cve-2015-7697.patch
|
|
UNZIP_IGNORE_CVES += CVE-2015-7697
|
|
|
|
# 0019-cve-2016-9844-zipinfo-buffer-overflow.patch
|
|
UNZIP_IGNORE_CVES += CVE-2016-9844
|
|
|
|
# 0007-increase-size-of-cfactorstr.patch
|
|
UNZIP_IGNORE_CVES += CVE-2018-18384
|
|
|
|
# 0020-cve-2018-1000035-unzip-buffer-overflow.patch
|
|
UNZIP_IGNORE_CVES += CVE-2018-1000035
|
|
|
|
# 0022-cve-2019-13232-fix-bug-in-undefer-input.patch
|
|
# 0023-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
|
|
# 0024-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch
|
|
# 0025-cve-2019-13232-fix-bug-in-uzbunzip2.patch
|
|
# 0026-cve-2019-13232-fix-bug-in-uzinflate.patch
|
|
UNZIP_IGNORE_CVES += CVE-2019-13232
|
|
|
|
# 0028-cve-2022-0529-and-cve-2022-0530.patch
|
|
UNZIP_IGNORE_CVES += CVE-2022-0529 CVE-2022-0530
|
|
|
|
# 0032-Fix-null-pointer-dereference-and-use-of-uninitialized-data.patch
|
|
UNZIP_IGNORE_CVES += CVE-2021-4217
|
|
|
|
# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when
|
|
# necessary, redefining it on the command line causes some warnings.
|
|
UNZIP_TARGET_CFLAGS = \
|
|
$(filter-out -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE,$(TARGET_CFLAGS))
|
|
|
|
# unzip already defines _LARGEFILE_SOURCE and _LARGEFILE64_SOURCE when
|
|
# necessary, redefining it on the command line causes some warnings.
|
|
UNZIP_TARGET_CXXFLAGS = \
|
|
$(filter-out -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE,$(TARGET_CXXFLAGS))
|
|
|
|
UNZIP_CONF_OPTS += \
|
|
-DCMAKE_C_FLAGS="$(UNZIP_TARGET_CFLAGS) -DLARGE_FILE_SUPPORT" \
|
|
-DCMAKE_CXX_FLAGS="$(UNZIP_TARGET_CXXFLAGS) -DLARGE_FILE_SUPPORT"
|
|
|
|
$(eval $(cmake-package))
|