From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Peter Korsgaard <peter@korsgaard.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/xterm: security bump to patch 376
Date: Sun, 20 Nov 2022 10:05:46 +0100 [thread overview]
Message-ID: <20221120090545.GP2123054@scaer> (raw)
In-Reply-To: <20221119134510.826956-1-peter@korsgaard.com>
Peter, All
On 2022-11-19 14:45 +0100, Peter Korsgaard spake thusly:
> Fixes the following security issue:
>
> CVE-2022-45063: xterm before 375 allows code execution via font ops, e.g.,
> because an OSC 50 response may have Ctrl-g and therefore lead to command
> execution within the vi line-editing mode of Zsh:
>
> https://www.openwall.com/lists/oss-security/2022/11/10/1
>
> Additionally, patch 376 fixes a null pointer access issue:
>
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022942
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Applied to master, thanks.
Regards,
Yann E. MORIN.
> ---
> package/xterm/xterm.hash | 2 +-
> package/xterm/xterm.mk | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/package/xterm/xterm.hash b/package/xterm/xterm.hash
> index 3f6ec765ce..12cd2e639b 100644
> --- a/package/xterm/xterm.hash
> +++ b/package/xterm/xterm.hash
> @@ -1,4 +1,4 @@
> # Locally calculated after checking pgp signature
> -sha256 32f888277b19e28ebc0a3112bff000607c07bed0679caa0beebb36f9cad484f5 xterm-371.tgz
> +sha256 1e5bb7aad068fb31d6d3cbb77f80c7ad1526cd4c956a4ddcf2c5cf28af5334e1 xterm-376.tgz
> # Locally calculated
> sha256 9521ef761474cd31ea406f56a751646a7b42a9287cdc6f2f8e52ed4c4d2a73e7 COPYING
> diff --git a/package/xterm/xterm.mk b/package/xterm/xterm.mk
> index 95984f1cf9..d01b608d99 100644
> --- a/package/xterm/xterm.mk
> +++ b/package/xterm/xterm.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -XTERM_VERSION = 371
> +XTERM_VERSION = 376
> XTERM_SOURCE = xterm-$(XTERM_VERSION).tgz
> XTERM_SITE = http://invisible-mirror.net/archives/xterm
> XTERM_DEPENDENCIES = ncurses xlib_libXaw host-pkgconf
> --
> 2.30.2
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2022-11-20 9:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-19 13:45 [Buildroot] [PATCH] package/xterm: security bump to patch 376 Peter Korsgaard
2022-11-20 9:05 ` Yann E. MORIN [this message]
2022-11-23 9:47 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221120090545.GP2123054@scaer \
--to=yann.morin.1998@free.fr \
--cc=buildroot@buildroot.org \
--cc=peter@korsgaard.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.