mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
b28f9363c5
Fixes the following vulnerabilities:
- CVE-2018-6952:
A double free exists in the another_hunk function in pch.c in GNU
patch through 2.7.6.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2018-6952
- https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706262bf204d6e03322c300
- CVE-2019-20633:
GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free
vulnerability in the function another_hunk in pch.c that can cause a
denial of service via a crafted patch file. NOTE: this issue exists
because of an incomplete fix for CVE-2018-6952.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2019-20633
- https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=15b158db3ae11cb835f2eb8d2eb48e09d1a4af48
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
40 lines
1.1 KiB
Makefile
40 lines
1.1 KiB
Makefile
################################################################################
|
|
#
|
|
# patch
|
|
#
|
|
################################################################################
|
|
|
|
PATCH_VERSION = 2.7.6
|
|
PATCH_SOURCE = patch-$(PATCH_VERSION).tar.xz
|
|
PATCH_SITE = $(BR2_GNU_MIRROR)/patch
|
|
PATCH_LICENSE = GPL-3.0+
|
|
PATCH_LICENSE_FILES = COPYING
|
|
PATCH_CPE_ID_VENDOR = gnu
|
|
|
|
# 0001-Fix-segfault-with-mangled-rename-patch.patch
|
|
PATCH_IGNORE_CVES += CVE-2018-6951
|
|
|
|
# 0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch
|
|
PATCH_IGNORE_CVES += CVE-2018-1000156
|
|
|
|
# 0004-Invoke-ed-directly-instead-of-using-the-shell.patch
|
|
PATCH_IGNORE_CVES += CVE-2018-20969 CVE-2019-13638
|
|
|
|
# 0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch
|
|
PATCH_IGNORE_CVES += CVE-2019-13636
|
|
|
|
# 0006-Fix-swapping-fake-lines-in-pch-swap.patch
|
|
PATCH_IGNORE_CVES += CVE-2018-6952
|
|
|
|
# 0007-Avoid-invalid-memory-access-in-context-format-diffs.patch
|
|
PATCH_IGNORE_CVES += CVE-2019-20633
|
|
|
|
ifeq ($(BR2_PACKAGE_ATTR),y)
|
|
PATCH_CONF_OPTS += --enable-xattr
|
|
PATCH_DEPENDENCIES += attr
|
|
else
|
|
PATCH_CONF_OPTS += --disable-xattr
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|