Files
buildroot/package
Fabrice Fontaine 210ccaef57 package/libid3tag: switch to debian to fix CVEs
Upstream libid3tag is dead since 2004 so switch to debian to get two
patches that fix the following CVEs:
 - CVE-2004-2779: id3_utf16_deserialize() in utf16.c in libid3tag
   through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd
   number of bytes, triggering an endless loop allocating memory until
   an OOM condition is reached, leading to denial-of-service (DoS).
 - CVE-2017-11550: The id3_ucs4_length function in ucs4.c in libid3tag
   0.15.1b allows remote attackers to cause a denial of service (NULL
   Pointer Dereference and application crash) via a crafted mp3 file.
 - CVE-2017-11551: The id3_field_parse function in field.c in libid3tag
   0.15.1b allows remote attackers to cause a denial of service (OOM)
   via a crafted MP3 file.

Moreover, drop patch (replaced by add-m4-directory.patch debian patch)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-04-12 22:21:02 +02:00
..
2020-04-07 08:01:28 +02:00
2020-04-11 09:48:58 +02:00
2020-04-07 07:49:08 +02:00
2020-04-10 22:43:08 +02:00
2020-04-10 21:30:14 +02:00
2020-04-11 09:51:06 +02:00
2020-04-10 22:31:29 +02:00
2020-04-08 21:22:41 +02:00
2020-04-06 22:13:57 +02:00
2020-04-04 22:30:44 +02:00
2020-04-12 10:43:30 +02:00
2020-04-05 16:25:43 +02:00
2020-04-08 16:53:23 +02:00
2020-04-08 21:18:57 +02:00
2020-04-12 13:38:08 +02:00
2020-04-06 21:40:23 +02:00
2020-04-11 14:55:24 +02:00
2020-04-04 17:30:37 +02:00
2020-04-01 21:51:06 +02:00
2020-04-11 10:07:02 +02:00
2020-04-04 23:40:43 +02:00
2020-04-12 21:51:54 +02:00