From: Peter Korsgaard <peter@korsgaard.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 0/4] spice: version bump / security bump
Date: Thu, 22 Jun 2017 00:07:40 +0200 [thread overview]
Message-ID: <20170621220744.18908-1-peter@korsgaard.com> (raw)
Our spice version is quite old (2013) and is affected by a number of
security issues, so bump to the latest release in the 0.12.x series +
upstream post-0.12.8 security fixes.
As the configuration options and dependencies have changed quite a bit since
2013, don't just do the entire bump in a single patch, but instead move
forward release by release for easier review.
Peter Korsgaard (4):
spice: bump to version 0.12.5
spice: security bump to version 0.12.6
spice: security bump to version 0.12.8
spice: add post-0.12.8 upstream security fixes
Config.in.legacy | 23 +++++++++
...sible-DoS-attempts-during-protocol-handsh.patch | 60 ++++++++++++++++++++++
...0001-fix-missing-monitor_latency-argument.patch | 28 ----------
...nt-integer-overflows-in-capability-checks.patch | 43 ++++++++++++++++
...l-Prevent-overflow-reading-messages-from-.patch | 33 ++++++++++++
package/spice/Config.in | 46 -----------------
package/spice/spice.hash | 2 +-
package/spice/spice.mk | 35 +++++--------
8 files changed, 174 insertions(+), 96 deletions(-)
create mode 100644 package/spice/0001-Prevent-possible-DoS-attempts-during-protocol-handsh.patch
delete mode 100644 package/spice/0001-fix-missing-monitor_latency-argument.patch
create mode 100644 package/spice/0002-Prevent-integer-overflows-in-capability-checks.patch
create mode 100644 package/spice/0003-main-channel-Prevent-overflow-reading-messages-from-.patch
--
2.11.0
next reply other threads:[~2017-06-21 22:07 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-21 22:07 Peter Korsgaard [this message]
2017-06-21 22:07 ` [Buildroot] [PATCH 1/4] spice: bump to version 0.12.5 Peter Korsgaard
2017-06-22 20:24 ` Yann E. MORIN
2017-06-21 22:07 ` [Buildroot] [PATCH 2/4] spice: security bump to version 0.12.6 Peter Korsgaard
2017-06-22 20:27 ` Yann E. MORIN
2017-06-21 22:07 ` [Buildroot] [PATCH 3/4] spice: security bump to version 0.12.8 Peter Korsgaard
2017-06-22 20:28 ` Yann E. MORIN
2017-06-21 22:07 ` [Buildroot] [PATCH 4/4] spice: add post-0.12.8 upstream security fixes Peter Korsgaard
2017-06-22 20:37 ` Yann E. MORIN
2017-06-22 21:23 ` Peter Korsgaard
2017-06-22 21:26 ` [Buildroot] [PATCH 0/4] spice: version bump / security bump Peter Korsgaard
2017-06-26 12:38 ` Peter Korsgaard
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170621220744.18908-1-peter@korsgaard.com \
--to=peter@korsgaard.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox