From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Petazzoni Date: Mon, 19 Aug 2019 15:46:03 +0200 Subject: [Buildroot] [PATCH 1/1] package/giflib: security bump to version 5.2.1 In-Reply-To: <20190818120432.22829-1-fontaine.fabrice@gmail.com> References: <20190818120432.22829-1-fontaine.fabrice@gmail.com> Message-ID: <20190819154603.51a042a2@windsurf.home> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: buildroot@busybox.net On Sun, 18 Aug 2019 14:04:32 +0200 Fabrice Fontaine wrote: > - Switch to generic-package (autotools has been dropped since version > 5.1.5) > - Remove hook and instead use dedicated makefile targets to build only > shared or static library and not binaries or documentation (added by > an upstreamble patch) > - ac_cv_prog_have_xmlto=no can be removed as doc is not built anymore > - Fix CVE-2018-11490: The DGifDecompressLine function in dgif_lib.c in > GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p > 0.49.4, has a heap-based buffer overflow because a certain > "Private->RunningCode - 2" array index is not checked. This will lead > to a denial of service or possibly unspecified other impact. > - Fix CVE-2019-15133: In GIFLIB before 2019-02-16, a malformed GIF file > triggers a divide-by-zero exception in the decoder function DGifSlurp > in dgif_lib.c if the height field of the ImageSize data structure is > equal to zero. > > Signed-off-by: Fabrice Fontaine > --- > ...dd-targets-to-manage-static-building.patch | 69 +++++++++++++++++++ > package/giflib/giflib.hash | 4 +- > package/giflib/giflib.mk | 47 +++++++++---- > 3 files changed, 104 insertions(+), 16 deletions(-) > create mode 100644 package/giflib/0001-Makefile-add-targets-to-manage-static-building.patch I must say this is quite big of a change for master at this point, and for a security bump in general. I'm not sure between applying this, or just cherry-picking the two commits that fix the CVEs. Thomas -- Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com