From 7453cf8b304eae3ce386c64fe1739e21b2559edb Mon Sep 17 00:00:00 2001 From: Patrick J Volkerding Date: Wed, 1 Feb 2023 22:27:31 +0000 Subject: Wed Feb 1 22:27:31 UTC 2023 patches/packages/apr-1.7.2-x86_64-1_slack15.0.txz: Upgraded. This update fixes security issues: Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. (CVE-2022-24963) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) (CVE-2021-35940) For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-24963 https://www.cve.org/CVERecord?id=CVE-2021-35940 https://www.cve.org/CVERecord?id=CVE-2017-12613 (* Security fix *) patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txz: Upgraded. This update fixes a security issue: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. (CVE-2022-25147) For more information, see: https://www.cve.org/CVERecord?id=CVE-2022-25147 (* Security fix *) patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/thunderbird/102.7.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2023-04/ https://www.cve.org/CVERecord?id=CVE-2023-0430 (* Security fix *) --- patches/packages/apr-1.7.2-x86_64-1_slack15.0.txt | 11 ++ .../packages/apr-util-1.6.3-x86_64-1_slack15.0.txt | 11 ++ ...illa-thunderbird-102.7.0-x86_64-1_slack15.0.txt | 11 -- ...illa-thunderbird-102.7.1-x86_64-1_slack15.0.txt | 11 ++ patches/source/apr-util/apr-util.SlackBuild | 126 +++++++++++++++++++++ patches/source/apr-util/apr-util.url | 2 + patches/source/apr-util/slack-desc | 19 ++++ patches/source/apr/apr.SlackBuild | 121 ++++++++++++++++++++ patches/source/apr/apr.url | 2 + patches/source/apr/slack-desc | 19 ++++ 10 files changed, 322 insertions(+), 11 deletions(-) create mode 100644 patches/packages/apr-1.7.2-x86_64-1_slack15.0.txt create mode 100644 patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txt delete mode 100644 patches/packages/mozilla-thunderbird-102.7.0-x86_64-1_slack15.0.txt create mode 100644 patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txt create mode 100755 patches/source/apr-util/apr-util.SlackBuild create mode 100644 patches/source/apr-util/apr-util.url create mode 100644 patches/source/apr-util/slack-desc create mode 100755 patches/source/apr/apr.SlackBuild create mode 100644 patches/source/apr/apr.url create mode 100644 patches/source/apr/slack-desc (limited to 'patches') diff --git a/patches/packages/apr-1.7.2-x86_64-1_slack15.0.txt b/patches/packages/apr-1.7.2-x86_64-1_slack15.0.txt new file mode 100644 index 000000000..462103daa --- /dev/null +++ b/patches/packages/apr-1.7.2-x86_64-1_slack15.0.txt @@ -0,0 +1,11 @@ +apr: apr (Apache Portable Runtime) +apr: +apr: The mission of the Apache Portable Runtime (APR) is to provide a +apr: free library of C data structures and routines, forming a system +apr: portability layer to as many operating systems as possible. +apr: +apr: +apr: +apr: +apr: +apr: diff --git a/patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txt b/patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txt new file mode 100644 index 000000000..8a5614af8 --- /dev/null +++ b/patches/packages/apr-util-1.6.3-x86_64-1_slack15.0.txt @@ -0,0 +1,11 @@ +apr-util: apr-util (Apache Portable Runtime utilities) +apr-util: +apr-util: The mission of the Apache Portable Runtime (APR) is to provide a +apr-util: free library of C data structures and routines, forming a system +apr-util: portability layer to as many operating systems as possible. +apr-util: +apr-util: This package contains additional utility interfaces for APR; +apr-util: including support for XML, LDAP, database interfaces, URI parsing, +apr-util: and more. +apr-util: +apr-util: diff --git a/patches/packages/mozilla-thunderbird-102.7.0-x86_64-1_slack15.0.txt b/patches/packages/mozilla-thunderbird-102.7.0-x86_64-1_slack15.0.txt deleted file mode 100644 index 5acb7b92e..000000000 --- a/patches/packages/mozilla-thunderbird-102.7.0-x86_64-1_slack15.0.txt +++ /dev/null @@ -1,11 +0,0 @@ -mozilla-thunderbird: mozilla-thunderbird (Mozilla Thunderbird mail application) -mozilla-thunderbird: -mozilla-thunderbird: Mozilla Thunderbird is a redesign of the Mozilla mail component -mozilla-thunderbird: written using the XUL user interface language. Thunderbird makes -mozilla-thunderbird: emailing safer, faster, and easier than ever before with the -mozilla-thunderbird: industry's best implementations of features such as intelligent spam -mozilla-thunderbird: filters, built-in RSS reader, quick search, and much more. -mozilla-thunderbird: -mozilla-thunderbird: Homepage: http://www.mozilla.org/projects/thunderbird/ -mozilla-thunderbird: -mozilla-thunderbird: diff --git a/patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txt b/patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txt new file mode 100644 index 000000000..5acb7b92e --- /dev/null +++ b/patches/packages/mozilla-thunderbird-102.7.1-x86_64-1_slack15.0.txt @@ -0,0 +1,11 @@ +mozilla-thunderbird: mozilla-thunderbird (Mozilla Thunderbird mail application) +mozilla-thunderbird: +mozilla-thunderbird: Mozilla Thunderbird is a redesign of the Mozilla mail component +mozilla-thunderbird: written using the XUL user interface language. Thunderbird makes +mozilla-thunderbird: emailing safer, faster, and easier than ever before with the +mozilla-thunderbird: industry's best implementations of features such as intelligent spam +mozilla-thunderbird: filters, built-in RSS reader, quick search, and much more. +mozilla-thunderbird: +mozilla-thunderbird: Homepage: http://www.mozilla.org/projects/thunderbird/ +mozilla-thunderbird: +mozilla-thunderbird: diff --git a/patches/source/apr-util/apr-util.SlackBuild b/patches/source/apr-util/apr-util.SlackBuild new file mode 100755 index 000000000..7da5fdf04 --- /dev/null +++ b/patches/source/apr-util/apr-util.SlackBuild @@ -0,0 +1,126 @@ +#!/bin/bash + +# Copyright 2008, 2009, 2010, 2011, 2012, 2013, 2018, 2023 Patrick J. Volkerding, Sebeka, Minnesota, USA +# All rights reserved. +# +# Redistribution and use of this script, with or without modification, is +# permitted provided that the following conditions are met: +# +# 1. Redistributions of this script must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +cd $(dirname $0) ; CWD=$(pwd) + +PKGNAM=apr-util +VERSION=${VERSION:-$(echo apr-util-*.tar.bz2 | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} +BUILD=${BUILD:-1_slack15.0} + +# Automatically determine the architecture we're building on: +if [ -z "$ARCH" ]; then + case "$( uname -m )" in + i?86) export ARCH=i586 ;; + arm*) export ARCH=arm ;; + # Unless $ARCH is already set, use uname -m for all other archs: + *) export ARCH=$( uname -m ) ;; + esac +fi + +# If the variable PRINT_PACKAGE_NAME is set, then this script will report what +# the name of the created package would be, and then exit. This information +# could be useful to other scripts. +if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then + echo "$PKGNAM-$VERSION-$ARCH-$BUILD.txz" + exit 0 +fi + +NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} + +if [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "s390" ]; then + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "x86_64" ]; then + SLKCFLAGS="-O2 -fPIC" + LIBDIRSUFFIX="64" +else + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +fi + +TMP=${TMP:-/tmp} +PKG=$TMP/package-apr-util + +rm -rf $PKG +mkdir -p $TMP $PKG + +cd $TMP +rm -rf apr-util-$VERSION +tar xvf $CWD/apr-util-$VERSION.tar.bz2 || exit 1 +cd apr-util-$VERSION || exit 1 + +chown -R root:root . +find . \ + \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \ + -exec chmod 755 {} \+ -o \ + \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \ + -exec chmod 644 {} \+ + +CFLAGS="$SLKCFLAGS" \ +./configure \ + --prefix=/usr \ + --libdir=/usr/lib${LIBDIRSUFFIX} \ + --with-apr=/usr \ + --with-dbm=db44 \ + --with-berkeley-db \ + --with-mysql=/usr \ + --disable-util-dso \ + --without-gdbm \ + --with-ldap \ + --without-sqlite2 \ + --build=$ARCH-slackware-linux || exit 1 + +make $NUMJOBS || make || exit 1 +make dox || exit 1 +make install DESTDIR=$PKG || exit 1 + +# Don't ship .la files: +rm -f $PKG/{,usr/}lib${LIBDIRSUFFIX}/*.la + +find $PKG | xargs file | grep -e "executable" -e "shared object" \ + | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null + +mkdir -p $PKG/usr/doc/apr-util-$VERSION +cp -a \ + INSTALL.MySQL LICENSE NOTICE \ + $PKG/usr/doc/apr-util-$VERSION + +# If there's a CHANGES file, installing at least part of the recent history +# is useful, but don't let it get totally out of control: +if [ -r CHANGES ]; then + DOCSDIR=$(echo $PKG/usr/doc/*-$VERSION) + cat CHANGES | head -n 1000 > $DOCSDIR/CHANGES + touch -r CHANGES $DOCSDIR/CHANGES +fi + +# This just seems like way too much stuff... +#mv docs/dox/html $PKG/usr/doc/apr-util-$VERSION + +mkdir -p $PKG/install +cat $CWD/slack-desc > $PKG/install/slack-desc + +# Build the package: +cd $PKG +/sbin/makepkg -l y -c n $TMP/apr-util-$VERSION-$ARCH-$BUILD.txz diff --git a/patches/source/apr-util/apr-util.url b/patches/source/apr-util/apr-util.url new file mode 100644 index 000000000..9f0e7e332 --- /dev/null +++ b/patches/source/apr-util/apr-util.url @@ -0,0 +1,2 @@ +http://www.apache.org/dist/apr/apr-util-1.6.3.tar.bz2 +http://www.apache.org/dist/apr/apr-util-1.6.3.tar.bz2.asc diff --git a/patches/source/apr-util/slack-desc b/patches/source/apr-util/slack-desc new file mode 100644 index 000000000..0e5f1009d --- /dev/null +++ b/patches/source/apr-util/slack-desc @@ -0,0 +1,19 @@ +# HOW TO EDIT THIS FILE: +# The "handy ruler" below makes it easier to edit a package description. Line +# up the first '|' above the ':' following the base package name, and the '|' +# on the right side marks the last column you can put a character in. You must +# make exactly 11 lines for the formatting to be correct. It's also +# customary to leave one space after the ':'. + + |-----handy-ruler------------------------------------------------------| +apr-util: apr-util (Apache Portable Runtime utilities) +apr-util: +apr-util: The mission of the Apache Portable Runtime (APR) is to provide a +apr-util: free library of C data structures and routines, forming a system +apr-util: portability layer to as many operating systems as possible. +apr-util: +apr-util: This package contains additional utility interfaces for APR; +apr-util: including support for XML, LDAP, database interfaces, URI parsing, +apr-util: and more. +apr-util: +apr-util: diff --git a/patches/source/apr/apr.SlackBuild b/patches/source/apr/apr.SlackBuild new file mode 100755 index 000000000..ce011a406 --- /dev/null +++ b/patches/source/apr/apr.SlackBuild @@ -0,0 +1,121 @@ +#!/bin/bash + +# Copyright 2008, 2009, 2010, 2011, 2018 Patrick J. Volkerding, Sebeka, Minnesota, USA +# All rights reserved. +# +# Redistribution and use of this script, with or without modification, is +# permitted provided that the following conditions are met: +# +# 1. Redistributions of this script must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +cd $(dirname $0) ; CWD=$(pwd) + +PKGNAM=apr +VERSION=${VERSION:-$(echo apr-*.tar.bz2 | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} +BUILD=${BUILD:-1_slack15.0} + +# Automatically determine the architecture we're building on: +if [ -z "$ARCH" ]; then + case "$( uname -m )" in + i?86) export ARCH=i586 ;; + arm*) export ARCH=arm ;; + # Unless $ARCH is already set, use uname -m for all other archs: + *) export ARCH=$( uname -m ) ;; + esac +fi + +# If the variable PRINT_PACKAGE_NAME is set, then this script will report what +# the name of the created package would be, and then exit. This information +# could be useful to other scripts. +if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then + echo "$PKGNAM-$VERSION-$ARCH-$BUILD.txz" + exit 0 +fi + +NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} + +if [ "$ARCH" = "i586" ]; then + SLKCFLAGS="-O2 -march=i586 -mtune=i686" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "s390" ]; then + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +elif [ "$ARCH" = "x86_64" ]; then + SLKCFLAGS="-O2 -fPIC" + LIBDIRSUFFIX="64" +else + SLKCFLAGS="-O2" + LIBDIRSUFFIX="" +fi + +TMP=${TMP:-/tmp} +PKG=$TMP/package-apr + +rm -rf $PKG +mkdir -p $TMP $PKG + +cd $TMP +rm -rf apr-$VERSION +tar xvf $CWD/apr-$VERSION.tar.bz2 || exit 1 +cd apr-$VERSION || exit 1 + +chown -R root:root . +find . \ + \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \ + -exec chmod 755 {} \+ -o \ + \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \ + -exec chmod 644 {} \+ + +CFLAGS="$SLKCFLAGS" \ +./configure \ + --prefix=/usr \ + --libdir=/usr/lib${LIBDIRSUFFIX} \ + --with-installbuilddir=/usr/lib${LIBDIRSUFFIX}/apr-${VERSION}/build-1 \ + --disable-static \ + --with-devrandom=/dev/urandom \ + --build=$ARCH-slackware-linux || exit 1 + +make $NUMJOBS || make || exit 1 +make dox || exit 1 +make install DESTDIR=$PKG || exit 1 + +# Don't ship .la files: +rm -f $PKG/{,usr/}lib${LIBDIRSUFFIX}/*.la + +find $PKG | xargs file | grep -e "executable" -e "shared object" \ + | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null + +mkdir -p $PKG/usr/doc/apr-$VERSION +cp -a \ + LICENSE NOTICE README* \ + $PKG/usr/doc/apr-$VERSION + +# If there's a CHANGES file, installing at least part of the recent history +# is useful, but don't let it get totally out of control: +if [ -r CHANGES ]; then + DOCSDIR=$(echo $PKG/usr/doc/*-$VERSION) + cat CHANGES | head -n 1000 > $DOCSDIR/CHANGES + touch -r CHANGES $DOCSDIR/CHANGES +fi + +# This just seems like way too much stuff... +#mv docs/dox/html $PKG/usr/doc/apr-$VERSION + +mkdir -p $PKG/install +cat $CWD/slack-desc > $PKG/install/slack-desc + +# Build the package: +cd $PKG +/sbin/makepkg -l y -c n $TMP/apr-$VERSION-$ARCH-$BUILD.txz diff --git a/patches/source/apr/apr.url b/patches/source/apr/apr.url new file mode 100644 index 000000000..064ec5fa6 --- /dev/null +++ b/patches/source/apr/apr.url @@ -0,0 +1,2 @@ +http://www.apache.org/dist/apr/apr-1.7.2.tar.bz2 +http://www.apache.org/dist/apr/apr-1.7.2.tar.bz2.asc diff --git a/patches/source/apr/slack-desc b/patches/source/apr/slack-desc new file mode 100644 index 000000000..bc9236870 --- /dev/null +++ b/patches/source/apr/slack-desc @@ -0,0 +1,19 @@ +# HOW TO EDIT THIS FILE: +# The "handy ruler" below makes it easier to edit a package description. Line +# up the first '|' above the ':' following the base package name, and the '|' +# on the right side marks the last column you can put a character in. You must +# make exactly 11 lines for the formatting to be correct. It's also +# customary to leave one space after the ':'. + + |-----handy-ruler------------------------------------------------------| +apr: apr (Apache Portable Runtime) +apr: +apr: The mission of the Apache Portable Runtime (APR) is to provide a +apr: free library of C data structures and routines, forming a system +apr: portability layer to as many operating systems as possible. +apr: +apr: +apr: +apr: +apr: +apr: -- cgit v1.2.3-79-gdb01