diff options
Diffstat (limited to 'source/l')
-rwxr-xr-x | source/l/glibc/glibc.SlackBuild | 2 | ||||
-rw-r--r-- | source/l/glibc/patches/glibc-2.37.CVE-2023-4911.patch | 70 | ||||
-rwxr-xr-x | source/l/mozilla-nss/mozilla-nss.SlackBuild | 2 | ||||
-rwxr-xr-x | source/l/poppler/poppler.SlackBuild | 4 |
4 files changed, 75 insertions, 3 deletions
diff --git a/source/l/glibc/glibc.SlackBuild b/source/l/glibc/glibc.SlackBuild index f8ed0d813..bac317163 100755 --- a/source/l/glibc/glibc.SlackBuild +++ b/source/l/glibc/glibc.SlackBuild @@ -25,7 +25,7 @@ cd $(dirname $0) ; CWD=$(pwd) PKGNAM=glibc VERSION=${VERSION:-$(echo glibc-*.tar.xz | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} CHECKOUT=${CHECKOUT:-""} -BUILD=${BUILD:-2} +BUILD=${BUILD:-3} # I was considering disabling NSCD, but MoZes talked me out of it. :) #DISABLE_NSCD=" --disable-nscd " diff --git a/source/l/glibc/patches/glibc-2.37.CVE-2023-4911.patch b/source/l/glibc/patches/glibc-2.37.CVE-2023-4911.patch new file mode 100644 index 000000000..074317990 --- /dev/null +++ b/source/l/glibc/patches/glibc-2.37.CVE-2023-4911.patch @@ -0,0 +1,70 @@ +From 1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa Mon Sep 17 00:00:00 2001 +From: Siddhesh Poyarekar <siddhesh@sourceware.org> +Date: Tue, 19 Sep 2023 18:39:32 -0400 +Subject: [PATCH] tunables: Terminate if end of input is reached + (CVE-2023-4911) + +The string parsing routine may end up writing beyond bounds of tunestr +if the input tunable string is malformed, of the form name=name=val. +This gets processed twice, first as name=name=val and next as name=val, +resulting in tunestr being name=name=val:name=val, thus overflowing +tunestr. + +Terminate the parsing loop at the first instance itself so that tunestr +does not overflow. + +Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org> +Reviewed-by: Carlos O'Donell <carlos@redhat.com> +--- + NEWS | 5 +++++ + elf/dl-tunables.c | 17 +++++++++------- + + +--- ./NEWS.orig 2023-01-31 21:27:45.000000000 -0600 ++++ ./NEWS 2023-10-03 15:47:54.560781260 -0500 +@@ -28,6 +28,11 @@ + heap and prints it to the target log file, potentially revealing a + portion of the contents of the heap. + ++ CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the ++ environment of a setuid program and NAME is valid, it may result in a ++ buffer overflow, which could be exploited to achieve escalated ++ privileges. This flaw was introduced in glibc 2.34. ++ + The following bugs are resolved with this release: + + [12154] network: Cannot resolve hosts which have wildcard aliases +--- ./elf/dl-tunables.c.orig 2023-01-31 21:27:45.000000000 -0600 ++++ ./elf/dl-tunables.c 2023-10-03 15:47:54.560781260 -0500 +@@ -187,11 +187,7 @@ + /* If we reach the end of the string before getting a valid name-value + pair, bail out. */ + if (p[len] == '\0') +- { +- if (__libc_enable_secure) +- tunestr[off] = '\0'; +- return; +- } ++ break; + + /* We did not find a valid name-value pair before encountering the + colon. */ +@@ -251,9 +247,16 @@ + } + } + +- if (p[len] != '\0') +- p += len + 1; ++ /* We reached the end while processing the tunable string. */ ++ if (p[len] == '\0') ++ break; ++ ++ p += len + 1; + } ++ ++ /* Terminate tunestr before we leave. */ ++ if (__libc_enable_secure) ++ tunestr[off] = '\0'; + } + #endif + diff --git a/source/l/mozilla-nss/mozilla-nss.SlackBuild b/source/l/mozilla-nss/mozilla-nss.SlackBuild index b7f29b542..fec258230 100755 --- a/source/l/mozilla-nss/mozilla-nss.SlackBuild +++ b/source/l/mozilla-nss/mozilla-nss.SlackBuild @@ -26,7 +26,7 @@ cd $(dirname $0) ; CWD=$(pwd) PKGNAM=mozilla-nss SRCNAM=nss -VERSION=${VERSION:-3.93} +VERSION=${VERSION:-3.94} NSPR=${NSPR:-4.35} BUILD=${BUILD:-1} diff --git a/source/l/poppler/poppler.SlackBuild b/source/l/poppler/poppler.SlackBuild index 76768ad9b..1c8dd4909 100755 --- a/source/l/poppler/poppler.SlackBuild +++ b/source/l/poppler/poppler.SlackBuild @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2017, 2018, 2020 Patrick J. Volkerding, Sebeka, MN, USA +# Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2017, 2018, 2020, 2023 Patrick J. Volkerding, Sebeka, MN, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -25,6 +25,7 @@ cd $(dirname $0) ; CWD=$(pwd) PKGNAM=poppler VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z* | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} BUILD=${BUILD:-1} +QT6OPT=${QT6OPT:--DENABLE_QT6=OFF} # Automatically determine the architecture we're building on: if [ -z "$ARCH" ]; then @@ -94,6 +95,7 @@ cmake \ -DENABLE_XPDF_HEADERS=ON \ -DENABLE_UNSTABLE_API_ABI_HEADERS=ON \ -DENABLE_ZLIB=ON \ + $QT6OPT \ .. || exit 1 make $NUMJOBS || make || exit 1 |