Fri Mar 24 19:42:46 UTC 202320230324194246

a/glibc-zoneinfo-2023b-noarch-1.txz:  Upgraded.
  This package provides the latest timezone updates.
a/libbytesize-2.8-x86_64-1.txz:  Upgraded.
a/tar-1.34-x86_64-3.txz:  Rebuilt.
  GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use
  of uninitialized memory for a conditional jump. Exploitation to change the
  flow of control has not been demonstrated. The issue occurs in from_header
  in list.c via a V7 archive in which mtime has approximately 11 whitespace
  characters.
  Thanks to marav for the heads-up.
  For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2022-48303
  (* Security fix *)
ap/sqlite-3.41.2-x86_64-1.txz:  Upgraded.
d/mercurial-6.4-x86_64-1.txz:  Upgraded.
n/openvpn-2.6.2-x86_64-1.txz:  Upgraded.
x/xorg-server-xwayland-23.1.0-x86_64-1.txz:  Upgraded.

3 files changed, 38 insertions, 4 deletions

diff --git a/source/a/tar/CVE-2022-48303.patch b/source/a/tar/CVE-2022-48303.patch
new file mode 100644
index 000000000..b248fb089
--- /dev/null
+++ b/source/a/tar/CVE-2022-48303.patch
@@ -0,0 +1,31 @@
+From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com>
+Date: Wed, 11 Jan 2023 08:55:58 +0100
+Subject: [PATCH] Fix savannah bug #62387
+
+* src/list.c (from_header): Check for the end of field after leading byte
+  (0x80 or 0xff) of base-256 encoded header value
+---
+ src/list.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc425..bf41b581 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type,
+ 			   << (CHAR_BIT * sizeof (uintmax_t)
+ 			       - LG_256 - (LG_256 - 2)));
+       value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit;
++      if (where == lim)
++        {
++          if (type && !silent)
++            ERROR ((0, 0, _("Archive base-256 value is invalid")));
++          return -1;
++        }
+       for (;;)
+ 	{
+ 	  value = (value << LG_256) + (unsigned char) *where++;
+-- 
+2.38.1
+
diff --git a/source/a/tar/tar.SlackBuild b/source/a/tar/tar.SlackBuild
index a22fe1eb2..20dcd4956 100755
--- a/source/a/tar/tar.SlackBuild
+++ b/source/a/tar/tar.SlackBuild
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2005-2022  Patrick J. Volkerding, Sebeka, MN, USA
+# Copyright 2005-2023  Patrick J. Volkerding, Sebeka, MN, USA
 # All rights reserved.
 #
 # Redistribution and use of this script, with or without modification, is
@@ -24,7 +24,7 @@ cd $(dirname $0) ; CWD=$(pwd)
 
 PKGNAM=tar
 VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
-BUILD=${BUILD:-2}
+BUILD=${BUILD:-3}
 
 NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "}
 
@@ -78,6 +78,9 @@ find . \
 # The "A lone zero block at %s" messages also cause problems:
 zcat $CWD/tar.nolonezero.diff.gz | patch -p1 --verbose || exit 1
 
+# Patch for CVE-2022-48303:
+zcat $CWD/CVE-2022-48303.patch.gz | patch -p1 --verbose || exit 1
+
 FORCE_UNSAFE_CONFIGURE=1 \
 CFLAGS="$SLKCFLAGS" \
 ./configure \
diff --git a/source/d/mercurial/mercurial.SlackBuild b/source/d/mercurial/mercurial.SlackBuild
index 5074b56a5..b5660cb1c 100755
--- a/source/d/mercurial/mercurial.SlackBuild
+++ b/source/d/mercurial/mercurial.SlackBuild
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2008, 2009, 2010, 2017, 2018  Patrick J. Volkerding, Sebeka, MN, USA
+# Copyright 2008, 2009, 2010, 2017, 2018, 2023  Patrick J. Volkerding, Sebeka, MN, USA
 # All rights reserved.
 #
 # Redistribution and use of this script, with or without modification, is
@@ -55,7 +55,7 @@ rm -rf mercurial-$VERSION
 tar xvf $CWD/mercurial-$VERSION.tar.?z || exit 1
 cd mercurial-$VERSION || exit 1
 
-chown -R root.root .
+chown -R root:root .
 find . \
   \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \
   -exec chmod 755 {} \+ -o \