Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2
@ 2017-10-14 11:37 Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 2/4] package/x11r7/xlib_libXres: bump version to 1.2.0 Bernd Kuhls
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Bernd Kuhls @ 2017-10-14 11:37 UTC (permalink / raw)
  To: buildroot

Removed patches applied upstream, added all upstream hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
 ...nd-of-string-in-PatternMatch-CVE-2017-137.patch | 34 --------------
 ...rties-Check-string-boundaries-CVE-2017-13.patch | 52 ----------------------
 package/x11r7/xlib_libXfont2/xlib_libXfont2.hash   |  7 ++-
 package/x11r7/xlib_libXfont2/xlib_libXfont2.mk     |  2 +-
 4 files changed, 6 insertions(+), 89 deletions(-)
 delete mode 100644 package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
 delete mode 100644 package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch

diff --git a/package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch b/package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
deleted file mode 100644
index 3795179af1..0000000000
--- a/package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From d1e670a4a8704b8708e493ab6155589bcd570608 Mon Sep 17 00:00:00 2001
-From: Michal Srb <msrb@suse.com>
-Date: Thu, 20 Jul 2017 13:38:53 +0200
-Subject: [PATCH] Check for end of string in PatternMatch (CVE-2017-13720)
-
-If a pattern contains '?' character, any character in the string is skipped,
-even if it is '\0'. The rest of the matching then reads invalid memory.
-
-Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
-Signed-off-by: Julien Cristau <jcristau@debian.org>
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
----
- src/fontfile/fontdir.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c
-index 4ce2473..996b7d1 100644
---- a/src/fontfile/fontdir.c
-+++ b/src/fontfile/fontdir.c
-@@ -400,8 +400,10 @@ PatternMatch(char *pat, int patdashes, char *string, int stringdashes)
- 		}
- 	    }
- 	case '?':
--	    if (*string++ == XK_minus)
-+	    if ((t = *string++) == XK_minus)
- 		stringdashes--;
-+	    if (!t)
-+		return 0;
- 	    break;
- 	case '\0':
- 	    return (*string == '\0');
--- 
-2.11.0
-
diff --git a/package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch b/package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch
deleted file mode 100644
index 709e446efe..0000000000
--- a/package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 672bb944311392e2415b39c0d63b1e1902905bcd Mon Sep 17 00:00:00 2001
-From: Michal Srb <msrb@suse.com>
-Date: Thu, 20 Jul 2017 17:05:23 +0200
-Subject: [PATCH] pcfGetProperties: Check string boundaries (CVE-2017-13722)
-
-Without the checks a malformed PCF file can cause the library to make
-atom from random heap memory that was behind the `strings` buffer.
-This may crash the process or leak information.
-
-Signed-off-by: Julien Cristau <jcristau@debian.org>
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
----
- src/bitmap/pcfread.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/src/bitmap/pcfread.c b/src/bitmap/pcfread.c
-index dab1c44..ae34c28 100644
---- a/src/bitmap/pcfread.c
-+++ b/src/bitmap/pcfread.c
-@@ -45,6 +45,7 @@ from The Open Group.
- 
- #include <stdarg.h>
- #include <stdint.h>
-+#include <string.h>
- 
- void
- pcfError(const char* message, ...)
-@@ -311,11 +312,19 @@ pcfGetProperties(FontInfoPtr pFontInfo, FontFilePtr file,
-     if (IS_EOF(file)) goto Bail;
-     position += string_size;
-     for (i = 0; i < nprops; i++) {
-+	if (props[i].name >= string_size) {
-+	    pcfError("pcfGetProperties(): String starts out of bounds (%ld/%d)\n", props[i].name, string_size);
-+	    goto Bail;
-+	}
- 	props[i].name = MakeAtom(strings + props[i].name,
--				 strlen(strings + props[i].name), TRUE);
-+				 strnlen(strings + props[i].name, string_size - props[i].name), TRUE);
- 	if (isStringProp[i]) {
-+	    if (props[i].value >= string_size) {
-+		pcfError("pcfGetProperties(): String starts out of bounds (%ld/%d)\n", props[i].value, string_size);
-+		goto Bail;
-+	    }
- 	    props[i].value = MakeAtom(strings + props[i].value,
--				      strlen(strings + props[i].value), TRUE);
-+				      strnlen(strings + props[i].value, string_size - props[i].value), TRUE);
- 	}
-     }
-     free(strings);
--- 
-2.11.0
-
diff --git a/package/x11r7/xlib_libXfont2/xlib_libXfont2.hash b/package/x11r7/xlib_libXfont2/xlib_libXfont2.hash
index 81a3c9f1ea..3e763b268f 100644
--- a/package/x11r7/xlib_libXfont2/xlib_libXfont2.hash
+++ b/package/x11r7/xlib_libXfont2/xlib_libXfont2.hash
@@ -1,2 +1,5 @@
-# From https://lists.x.org/archives/xorg-announce/2015-December/002663.html
-sha256 e9fbbb475ddd171b3a6a54b989cbade1f6f874fc35d505ebc5be426bc6e4db7e  libXfont2-2.0.1.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002813.html
+md5 d39e6446e46f939486d1a8b856e8b67b  libXfont2-2.0.2.tar.bz2
+sha1 d5117914a026b3fd47123cb1c2a22daaae3b63e4  libXfont2-2.0.2.tar.bz2
+sha256 94088d3b87f7d42c7116d9adaad155859e93330c6e47f5989f2de600b9a6c111  libXfont2-2.0.2.tar.bz2
+sha512 d62b0c3d663a2c668796cca8c6c2a90f83feeae1253b7d946668d33502cd8099c963285b88db4f745efb0d4ff783c118eb3d84cb8e6e1724586e1ef2be23e593  libXfont2-2.0.2.tar.bz2
diff --git a/package/x11r7/xlib_libXfont2/xlib_libXfont2.mk b/package/x11r7/xlib_libXfont2/xlib_libXfont2.mk
index fef1e68323..696c605a36 100644
--- a/package/x11r7/xlib_libXfont2/xlib_libXfont2.mk
+++ b/package/x11r7/xlib_libXfont2/xlib_libXfont2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XLIB_LIBXFONT2_VERSION = 2.0.1
+XLIB_LIBXFONT2_VERSION = 2.0.2
 XLIB_LIBXFONT2_SOURCE = libXfont2-$(XLIB_LIBXFONT2_VERSION).tar.bz2
 XLIB_LIBXFONT2_SITE = http://xorg.freedesktop.org/releases/individual/lib
 XLIB_LIBXFONT2_LICENSE = MIT
-- 
2.11.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [Buildroot] [PATCH 2/4] package/x11r7/xlib_libXres: bump version to 1.2.0
  2017-10-14 11:37 [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Bernd Kuhls
@ 2017-10-14 11:37 ` Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 3/4] package/libdrm: bump version to 2.4.84 Bernd Kuhls
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 6+ messages in thread
From: Bernd Kuhls @ 2017-10-14 11:37 UTC (permalink / raw)
  To: buildroot

Added all hashes provided by upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
 package/x11r7/xlib_libXres/xlib_libXres.hash | 7 +++++--
 package/x11r7/xlib_libXres/xlib_libXres.mk   | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package/x11r7/xlib_libXres/xlib_libXres.hash b/package/x11r7/xlib_libXres/xlib_libXres.hash
index 063df8e954..12a03518af 100644
--- a/package/x11r7/xlib_libXres/xlib_libXres.hash
+++ b/package/x11r7/xlib_libXres/xlib_libXres.hash
@@ -1,2 +1,5 @@
-# From http://lists.x.org/archives/xorg-announce/2013-May/002233.html
-sha256	26899054aa87f81b17becc68e8645b240f140464cf90c42616ebb263ec5fa0e5	libXres-1.0.7.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002812.html
+md5 5d6d443d1abc8e1f6fc1c57fb27729bb  libXres-1.2.0.tar.bz2
+sha1 b6996ab05460a3b7311f02da23ddf117a5442fd9  libXres-1.2.0.tar.bz2
+sha256 ff75c1643488e64a7cfbced27486f0f944801319c84c18d3bd3da6bf28c812d4  libXres-1.2.0.tar.bz2
+sha512 8eb5a36b1f030eb4e27e676cc4befcc073da66a7bce2b39089314e1facb629d13b087bb53ca2c95fe5291857da7ff9f80c6ab28fb3e245eeb9e0344937900172  libXres-1.2.0.tar.bz2
diff --git a/package/x11r7/xlib_libXres/xlib_libXres.mk b/package/x11r7/xlib_libXres/xlib_libXres.mk
index 853f54205e..0075e8f60b 100644
--- a/package/x11r7/xlib_libXres/xlib_libXres.mk
+++ b/package/x11r7/xlib_libXres/xlib_libXres.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XLIB_LIBXRES_VERSION = 1.0.7
+XLIB_LIBXRES_VERSION = 1.2.0
 XLIB_LIBXRES_SOURCE = libXres-$(XLIB_LIBXRES_VERSION).tar.bz2
 XLIB_LIBXRES_SITE = http://xorg.freedesktop.org/releases/individual/lib
 XLIB_LIBXRES_LICENSE = MIT
-- 
2.11.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [Buildroot] [PATCH 3/4] package/libdrm: bump version to 2.4.84
  2017-10-14 11:37 [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 2/4] package/x11r7/xlib_libXres: bump version to 1.2.0 Bernd Kuhls
@ 2017-10-14 11:37 ` Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5 Bernd Kuhls
  2017-10-15 13:57 ` [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Thomas Petazzoni
  3 siblings, 0 replies; 6+ messages in thread
From: Bernd Kuhls @ 2017-10-14 11:37 UTC (permalink / raw)
  To: buildroot

Changed _SITE to https.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
 package/libdrm/libdrm.hash | 10 +++++-----
 package/libdrm/libdrm.mk   |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/package/libdrm/libdrm.hash b/package/libdrm/libdrm.hash
index 704bf1b389..be24658b41 100644
--- a/package/libdrm/libdrm.hash
+++ b/package/libdrm/libdrm.hash
@@ -1,5 +1,5 @@
-# From https://lists.freedesktop.org/archives/dri-devel/2017-August/151077.html
-md5 23800953ed7564988872e1e8c61fde31  libdrm-2.4.83.tar.bz2
-sha1 f78d392684d6e482e8c0a85d355619ac64c4ad6a  libdrm-2.4.83.tar.bz2
-sha256 03a52669da60ead62548a35bc430aafb6c2d8dd21ec9dba3a90f96eff5fe36d6  libdrm-2.4.83.tar.bz2
-sha512 8f894ff61939bca03ac857506a84bbbcbe2367e60c91a0f2388bfce5ae81e12ba2f96fe1c962416cf9e2d25ef04b98b5437c7015497789561311a72607b3bfcb  libdrm-2.4.83.tar.bz2
+# From https://lists.freedesktop.org/archives/dri-devel/2017-October/154645.html
+md5 35b9544bc2ad864acd1abaa1a2b99092  libdrm-2.4.84.tar.bz2
+sha1 3a8835aaef89648757593f00008de9eff95990dd  libdrm-2.4.84.tar.bz2
+sha256 7ae9c24d91139ac9a2cdee06fe46dbe1c401a1eda1c0bd2a6d1ecf72f479e0aa  libdrm-2.4.84.tar.bz2
+sha512 860ebc5fa934edee97e9e7e13aaa2f2e70a68b946f4f3893cd7f93b8296c10b3cd4ce4c23b1676eefe375286e6e2292b96e917d7976f65c61da3fa661e5e641a  libdrm-2.4.84.tar.bz2
diff --git a/package/libdrm/libdrm.mk b/package/libdrm/libdrm.mk
index e4d3e3947b..da100b853b 100644
--- a/package/libdrm/libdrm.mk
+++ b/package/libdrm/libdrm.mk
@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-LIBDRM_VERSION = 2.4.83
+LIBDRM_VERSION = 2.4.84
 LIBDRM_SOURCE = libdrm-$(LIBDRM_VERSION).tar.bz2
-LIBDRM_SITE = http://dri.freedesktop.org/libdrm
+LIBDRM_SITE = https://dri.freedesktop.org/libdrm
 LIBDRM_LICENSE = MIT
 LIBDRM_INSTALL_STAGING = YES
 LIBDRM_DEPENDENCIES = \
-- 
2.11.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5
  2017-10-14 11:37 [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 2/4] package/x11r7/xlib_libXres: bump version to 1.2.0 Bernd Kuhls
  2017-10-14 11:37 ` [Buildroot] [PATCH 3/4] package/libdrm: bump version to 2.4.84 Bernd Kuhls
@ 2017-10-14 11:37 ` Bernd Kuhls
  2017-10-15 21:00   ` Peter Korsgaard
  2017-10-15 13:57 ` [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Thomas Petazzoni
  3 siblings, 1 reply; 6+ messages in thread
From: Bernd Kuhls @ 2017-10-14 11:37 UTC (permalink / raw)
  To: buildroot

Fixes

xfixes: unvalidated lengths (CVE-2017-12183)

Xi: fix wrong extra length check in ProcXIChangeHierarchy
 (CVE-2017-12178)

dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
 (CVE-2017-12177)

Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
 .../{1.19.4 => 1.19.5}/0001-modesettings-needs-dri2.patch      |  0
 .../0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch      |  0
 .../0003-Remove-check-for-useSIGIO-option.patch                |  0
 package/x11r7/xserver_xorg-server/Config.in                    |  4 ++--
 package/x11r7/xserver_xorg-server/xserver_xorg-server.hash     | 10 +++++-----
 5 files changed, 7 insertions(+), 7 deletions(-)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0001-modesettings-needs-dri2.patch (100%)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch (100%)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0003-Remove-check-for-useSIGIO-option.patch (100%)

diff --git a/package/x11r7/xserver_xorg-server/1.19.4/0001-modesettings-needs-dri2.patch b/package/x11r7/xserver_xorg-server/1.19.5/0001-modesettings-needs-dri2.patch
similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0001-modesettings-needs-dri2.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0001-modesettings-needs-dri2.patch
diff --git a/package/x11r7/xserver_xorg-server/1.19.4/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch b/package/x11r7/xserver_xorg-server/1.19.5/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch
similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch
diff --git a/package/x11r7/xserver_xorg-server/1.19.4/0003-Remove-check-for-useSIGIO-option.patch b/package/x11r7/xserver_xorg-server/1.19.5/0003-Remove-check-for-useSIGIO-option.patch
similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0003-Remove-check-for-useSIGIO-option.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0003-Remove-check-for-useSIGIO-option.patch
diff --git a/package/x11r7/xserver_xorg-server/Config.in b/package/x11r7/xserver_xorg-server/Config.in
index 71164b3794..08dea0a5ef 100644
--- a/package/x11r7/xserver_xorg-server/Config.in
+++ b/package/x11r7/xserver_xorg-server/Config.in
@@ -79,7 +79,7 @@ choice
 	bool "X Window System server version"
 
 config BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
-	bool "1.19.3"
+	bool "1.19.5"
 	select BR2_PACKAGE_XSERVER_XORG_SERVER_VIDEODRV_ABI_23
 	select BR2_PACKAGE_XLIB_LIBXFONT2
 	select BR2_PACKAGE_XPROTO_PRESENTPROTO
@@ -99,7 +99,7 @@ endchoice
 
 config BR2_PACKAGE_XSERVER_XORG_SERVER_VERSION
 	string
-	default "1.19.4" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
+	default "1.19.5" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
 	default "1.17.4" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_17
 	default "1.14.7" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_14
 
diff --git a/package/x11r7/xserver_xorg-server/xserver_xorg-server.hash b/package/x11r7/xserver_xorg-server/xserver_xorg-server.hash
index d0acc24102..c0feb985d2 100644
--- a/package/x11r7/xserver_xorg-server/xserver_xorg-server.hash
+++ b/package/x11r7/xserver_xorg-server/xserver_xorg-server.hash
@@ -3,8 +3,8 @@ sha1   7a95765e56b124758fcd7b609589e65b8870880b                                x
 sha256 fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f        xorg-server-1.14.7.tar.bz2
 # From https://lists.x.org/archives/xorg-announce/2015-October/002650.html
 sha256 0c4b45c116a812a996eb432d8508cf26c2ec8c3916ff2a50781796882f8d6457        xorg-server-1.17.4.tar.bz2
-# From https://lists.x.org/archives/xorg-announce/2017-October/002808.html
-md5 28cb6d773bfcdfd43500dd64527d2ab0 xorg-server-1.19.4.tar.bz2
-sha1 7a47d5f927ea69681e279c6e5f5e8ff3a21c7152 xorg-server-1.19.4.tar.bz2
-sha256 aa758acea91deaf1f95069ddc5ea3818e13675fb14fef40ad1b3d0b2bf03c9a8 xorg-server-1.19.4.tar.bz2
-sha512 ff80934e42a7dd2d437e947fe02c74c3b25bdbb3002b7005191d52272d5eae8cb3a83377fa32f40000011be88405830e796f6bd3b914bd7fc163ea8ece76226b xorg-server-1.19.4.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002814.html
+md5 4ac6feeae6790436ce9de879ca9a3bf8  xorg-server-1.19.5.tar.bz2
+sha1 307d3405f709f7e41966c850b37deefe7f83eb9b  xorg-server-1.19.5.tar.bz2
+sha256 18fffa8eb93d06d2800d06321fc0df4d357684d8d714315a66d8dfa7df251447  xorg-server-1.19.5.tar.bz2
+sha512 928dea5850b98cd815004cfa133eca23cfa9521920c934c68a92787f2cae13cca1534eee772a4fb74b8ae8cb92662b5d68b95b834c8aa8ec57cd57cb4e5dd45c  xorg-server-1.19.5.tar.bz2
-- 
2.11.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2
  2017-10-14 11:37 [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Bernd Kuhls
                   ` (2 preceding siblings ...)
  2017-10-14 11:37 ` [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5 Bernd Kuhls
@ 2017-10-15 13:57 ` Thomas Petazzoni
  3 siblings, 0 replies; 6+ messages in thread
From: Thomas Petazzoni @ 2017-10-15 13:57 UTC (permalink / raw)
  To: buildroot

Hello,

On Sat, 14 Oct 2017 13:37:25 +0200, Bernd Kuhls wrote:
> Removed patches applied upstream, added all upstream hashes.
> 
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
> ---
>  ...nd-of-string-in-PatternMatch-CVE-2017-137.patch | 34 --------------
>  ...rties-Check-string-boundaries-CVE-2017-13.patch | 52 ----------------------
>  package/x11r7/xlib_libXfont2/xlib_libXfont2.hash   |  7 ++-
>  package/x11r7/xlib_libXfont2/xlib_libXfont2.mk     |  2 +-
>  4 files changed, 6 insertions(+), 89 deletions(-)
>  delete mode 100644 package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
>  delete mode 100644 package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch

All four patches applied. Thanks!

Thomas
-- 
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com

^ permalink raw reply	[flat|nested] 6+ messages in thread

* [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5
  2017-10-14 11:37 ` [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5 Bernd Kuhls
@ 2017-10-15 21:00   ` Peter Korsgaard
  0 siblings, 0 replies; 6+ messages in thread
From: Peter Korsgaard @ 2017-10-15 21:00 UTC (permalink / raw)
  To: buildroot

>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:

 > Fixes
 > xfixes: unvalidated lengths (CVE-2017-12183)

 > Xi: fix wrong extra length check in ProcXIChangeHierarchy
 >  (CVE-2017-12178)

 > dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
 >  (CVE-2017-12177)

 > Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

 > Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>

Committed to 2017.02.x, thanks.

-- 
Bye, Peter Korsgaard

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2017-10-15 21:00 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-14 11:37 [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Bernd Kuhls
2017-10-14 11:37 ` [Buildroot] [PATCH 2/4] package/x11r7/xlib_libXres: bump version to 1.2.0 Bernd Kuhls
2017-10-14 11:37 ` [Buildroot] [PATCH 3/4] package/libdrm: bump version to 2.4.84 Bernd Kuhls
2017-10-14 11:37 ` [Buildroot] [PATCH 4/4] package/x11r7/xserver_xorg-server: security bump version to 1.19.5 Bernd Kuhls
2017-10-15 21:00   ` Peter Korsgaard
2017-10-15 13:57 ` [Buildroot] [PATCH 1/4] package/x11r7/xlib_libXfont2: bump version to 2.0.2 Thomas Petazzoni

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox