October 2013 - CRUX - lists.crux.nu

ports/opt (3.0): [notify] qpdf: update to 5.0.1
by crux＠crux.nu 19 Oct '13

19 Oct '13

commit 35140262dc03b803aac4d40f90363bb2602f64c5 Author: Juergen Daubert <jue(a)jue.li> Date: Sat Oct 19 10:31:48 2013 +0200 [notify] qpdf: update to 5.0.1 Mostly security hardening changes, see http://sourceforge.net/mailarchive/message.php?msg_id=31536502 diff --git a/qpdf/.footprint b/qpdf/.footprint index 3a9f4f1..e91c0d3 100644 --- a/qpdf/.footprint +++ b/qpdf/.footprint @@ -34,9 +34,9 @@ drwxr-xr-x root/root usr/include/qpdf/ drwxr-xr-x root/root usr/lib/ -rw-r--r-- root/root usr/lib/libqpdf.a -rwxr-xr-x root/root usr/lib/libqpdf.la -lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.13.0.0 -lrwxrwxrwx root/root usr/lib/libqpdf.so.13 -> libqpdf.so.13.0.0 --rwxr-xr-x root/root usr/lib/libqpdf.so.13.0.0 +lrwxrwxrwx root/root usr/lib/libqpdf.so -> libqpdf.so.13.0.1 +lrwxrwxrwx root/root usr/lib/libqpdf.so.13 -> libqpdf.so.13.0.1 +-rwxr-xr-x root/root usr/lib/libqpdf.so.13.0.1 drwxr-xr-x root/root usr/lib/pkgconfig/ -rw-r--r-- root/root usr/lib/pkgconfig/libqpdf.pc drwxr-xr-x root/root usr/man/ diff --git a/qpdf/.md5sum b/qpdf/.md5sum index 484cce0..9349c97 100644 --- a/qpdf/.md5sum +++ b/qpdf/.md5sum @@ -1 +1 @@ -d501c61a8979132f6d601641483850cc qpdf-5.0.0.tar.gz +6efd89c18461cb73f77bb60cb2da4bce qpdf-5.0.1.tar.gz diff --git a/qpdf/Pkgfile b/qpdf/Pkgfile index 2966edc..ed62242 100644 --- a/qpdf/Pkgfile +++ b/qpdf/Pkgfile @@ -4,7 +4,7 @@ # Depends on: libpcre zlib name=qpdf -version=5.0.0 +version=5.0.1 release=1 source=(http://downloads.sourceforge.net/project/$name/$name/$version/$name…

1 0

ports/opt (3.0): [notify] jdk: update to 1.7.0_45
by crux＠crux.nu 17 Oct '13

17 Oct '13

commit dffab3b70c016a32c13be0902a6717bc4b2575c4 Author: Jose V Beneyto <sepen(a)crux.nu> Date: Thu Oct 17 11:44:32 2013 +0200 [notify] jdk: update to 1.7.0_45 Security fixes, see http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html diff --git a/jdk/.footprint b/jdk/.footprint index e952f4d..9a29a30 100644 --- a/jdk/.footprint +++ b/jdk/.footprint @@ -197,6 +197,7 @@ drwxr-xr-x root/root usr/lib/jdk/jre/lib/cmm/ -rwxr-xr-x root/root usr/lib/jdk/jre/lib/deploy.jar drwxr-xr-x root/root usr/lib/jdk/jre/lib/deploy/ -rw-r--r-- root/root usr/lib/jdk/jre/lib/deploy/MixedCodeMainDialog.ui +-rw-r--r-- root/root usr/lib/jdk/jre/lib/deploy/MixedCodeMainDialogJs.ui -rw-r--r-- root/root usr/lib/jdk/jre/lib/deploy/cautionshield.icns -rw-r--r-- root/root usr/lib/jdk/jre/lib/deploy/ffjcext.zip -rw-r--r-- root/root usr/lib/jdk/jre/lib/deploy/java-icon.ico @@ -844,6 +845,9 @@ drwxr-xr-x root/root usr/lib/jdk/jre/plugin/desktop/ -rw-r--r-- root/root usr/lib/jdk/jre/plugin/desktop/sun_java.desktop -rw-r--r-- root/root usr/lib/jdk/jre/plugin/desktop/sun_java.png drwxr-xr-x root/root usr/lib/jdk/lib/ +drwxr-xr-x root/root usr/lib/jdk/lib/amd64/ +drwxr-xr-x root/root usr/lib/jdk/lib/amd64/jli/ +-rwxr-xr-x root/root usr/lib/jdk/lib/amd64/jli/libjli.so -rw-r--r-- root/root usr/lib/jdk/lib/ant-javafx.jar -rw-r--r-- root/root usr/lib/jdk/lib/ct.sym -rw-r--r-- root/root usr/lib/jdk/lib/dt.jar diff --git a/jdk/.md5sum b/jdk/.md5sum index a8adf00..1f25dc7 100644 --- a/jdk/.md5sum +++ b/jdk/.md5sum @@ -1 +1 @@ -511ea34e4a42955bc03c28afa4b8f6cf jdk-7u40-linux-x64.tar.gz +bea330fcbcff77d31878f21753e09b30 jdk-7u45-linux-x64.tar.gz diff --git a/jdk/Pkgfile b/jdk/Pkgfile index 5c2902f..79efc91 100644 --- a/jdk/Pkgfile +++ b/jdk/Pkgfile @@ -4,7 +4,7 @@ # Packager: Simone Rota, sip at crux dot nu name=jdk -version=1.7.0_40 +version=1.7.0_45 release=1 source=(file:///$name-7u${version##*_}-linux-x64.tar.gz)

1 0

ports/opt (3.0): [notify] jre: update to 1.7.0_45
by crux＠crux.nu 16 Oct '13

16 Oct '13

commit d21b3bf3aee9a39cf4fc78bdcc67e2385580d712 Author: Juergen Daubert <jue(a)jue.li> Date: Wed Oct 16 18:23:01 2013 +0200 [notify] jre: update to 1.7.0_45 Security fixes, see http://www.oracle.com/technetwork/java/javase/7u45-relnotes-2016950.html diff --git a/jre/.footprint b/jre/.footprint index 6af2bc0..135a6b1 100644 --- a/jre/.footprint +++ b/jre/.footprint @@ -98,6 +98,7 @@ drwxr-xr-x root/root usr/lib/jre/lib/cmm/ -rwxr-xr-x root/root usr/lib/jre/lib/deploy.jar drwxr-xr-x root/root usr/lib/jre/lib/deploy/ -rw-r--r-- root/root usr/lib/jre/lib/deploy/MixedCodeMainDialog.ui +-rw-r--r-- root/root usr/lib/jre/lib/deploy/MixedCodeMainDialogJs.ui -rw-r--r-- root/root usr/lib/jre/lib/deploy/cautionshield.icns -rw-r--r-- root/root usr/lib/jre/lib/deploy/ffjcext.zip -rw-r--r-- root/root usr/lib/jre/lib/deploy/java-icon.ico diff --git a/jre/.md5sum b/jre/.md5sum index ab3b601..b7e8a0b 100644 --- a/jre/.md5sum +++ b/jre/.md5sum @@ -1 +1 @@ -0c775aa90b4c4919b000949f02e0ec5b jre-7u40-linux-x64.tar.gz +e82743de29c6cb59ae09bbcb090ccbee jre-7u45-linux-x64.tar.gz diff --git a/jre/Pkgfile b/jre/Pkgfile index 5c20856..f4d8637 100644 --- a/jre/Pkgfile +++ b/jre/Pkgfile @@ -4,9 +4,9 @@ # Packager: Simone Rota, sip at crux dot nu name=jre -version=1.7.0_40 +version=1.7.0_45 release=1 -source=(file:///$name-7u40-linux-x64.tar.gz) +source=(file:///$name-7u${version#*_}-linux-x64.tar.gz) build(){ cd $name$version

1 0

ports/opt (3.0): [notify] gnupg: 2.0.21 -> 2.0.22
by crux＠crux.nu 09 Oct '13

09 Oct '13

commit 70bca2317ce0e57ee7df2c5bca593104e53bbd04 Author: Thomas Penteker <tek(a)serverop.de> Date: Thu Oct 10 00:29:10 2013 +0200 [notify] gnupg: 2.0.21 -> 2.0.22 Fixes CVE-2013-4402 diff --git a/gnupg/Pkgfile b/gnupg/Pkgfile index e0aa329..e0ef97b 100644 --- a/gnupg/Pkgfile +++ b/gnupg/Pkgfile @@ -11,7 +11,7 @@ source=(ftp://ftp.gnupg.org/gcrypt/$name/$name-$version.tar.bz2) build () { - cd $name-$version + cd $name-$version ./configure \ --prefix=/usr \

1 0

ports/xorg (3.0): [notify] xorg-server: update, Fixes CVE-2013-4396
by crux＠crux.nu 09 Oct '13

09 Oct '13

commit f0674232c0af431b95993cae20ec5d873296472b Author: Danny Rawlins <monster.romster(a)gmail.com> Date: Wed Oct 9 19:16:15 2013 +1100 [notify] xorg-server: update, Fixes CVE-2013-4396 diff --git a/xorg-server/.md5sum b/xorg-server/.md5sum index 9845351..41b8ecf 100644 --- a/xorg-server/.md5sum +++ b/xorg-server/.md5sum @@ -1 +1,2 @@ +77c48738460f0dfa426da46f98efb4b4 cve-2013-4396.patch 86abeb08d3f7ead3a2bd3d6a9ba6714e xorg-server-1.14.3.tar.bz2 diff --git a/xorg-server/Pkgfile b/xorg-server/Pkgfile index 0b48682..09d2b6a 100644 --- a/xorg-server/Pkgfile +++ b/xorg-server/Pkgfile @@ -5,12 +5,15 @@ name=xorg-server version=1.14.3 -release=1 -source=(http://xorg.freedesktop.org/releases/individual/xserver/$name-$version.tar.bz2) +release=2 +source=(http://xorg.freedesktop.org/releases/individual/xserver/$name-$version.tar.bz2 + cve-2013-4396.patch) build() { cd $name-$version + patch -p1 -i $SRC/cve-2013-4396.patch + ./configure --prefix=/usr \ --mandir=/usr/man \ --localstatedir=/var \ diff --git a/xorg-server/cve-2013-4396.patch b/xorg-server/cve-2013-4396.patch new file mode 100644 index 0000000..b35fd6b --- /dev/null +++ b/xorg-server/cve-2013-4396.patch @@ -0,0 +1,77 @@ +From 7bddc2ba16a2a15773c2ea8947059afa27727764 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith(a)oracle.com> +Date: Mon, 16 Sep 2013 21:47:16 -0700 +Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText() + [CVE-2013-4396] + +Save a pointer to the passed in closure structure before copying it +and overwriting the *c pointer to point to our copy instead of the +original. If we hit an error, once we free(c), reset c to point to +the original structure before jumping to the cleanup code that +references *c. + +Since one of the errors being checked for is whether the server was +able to malloc(c->nChars * itemSize), the client can potentially pass +a number of characters chosen to cause the malloc to fail and the +error path to be taken, resulting in the read from freed memory. + +Since the memory is accessed almost immediately afterwards, and the +X server is mostly single threaded, the odds of the free memory having +invalid contents are low with most malloc implementations when not using +memory debugging features, but some allocators will definitely overwrite +the memory there, leading to a likely crash. + +Reported-by: Pedro Ribeiro <pedrib(a)gmail.com> +Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> +Reviewed-by: Julien Cristau <jcristau(a)debian.org> +--- + dix/dixfonts.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/dix/dixfonts.c b/dix/dixfonts.c +index feb765d..2e34d37 100644 +--- a/dix/dixfonts.c ++++ b/dix/dixfonts.c +@@ -1425,6 +1425,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + GC *pGC; + unsigned char *data; + ITclosurePtr new_closure; ++ ITclosurePtr old_closure; + + /* We're putting the client to sleep. We need to + save some state. Similar problem to that handled +@@ -1436,12 +1437,14 @@ doImageText(ClientPtr client, ITclosurePtr c) + err = BadAlloc; + goto bail; + } ++ old_closure = c; + *new_closure = *c; + c = new_closure; + + data = malloc(c->nChars * itemSize); + if (!data) { + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1452,6 +1455,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + if (!pGC) { + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1464,6 +1468,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + FreeScratchGC(pGC); + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +-- +1.7.9.2 + +

1 0

CruxEX live with LXDE and kernel 3.11.4!
by C A Exton 08 Oct '13

08 Oct '13

NEWS 131008 Install my new version of CruxEX 3.0 64 bit from 131008 to a USB Pen Drive and save your system changes - read this <http://cruxex.exton.net/cruxex-3.0-pen-drive> INSTRUCTION (http://cruxex.exton.net/cruxex-3.0-pen-drive) If you later on decide you want to install CruxEX to hard drive from the USB Pen Drive all your system changes will also be installed to the hard drive. CruxEX 2013 is a live version of CRUX 3.0. It uses LXDE as Desktop environment and kernel 3.11.4-x86_64-exton. READ MORE: http://cruxex.exton.net <http://cruxex.exton.net/>

2 1

RE: Lilo Fatal error
by Thomas Penteker 06 Oct '13

06 Oct '13

On 06.10.2013 10:14, Roelof Wobben wrote: > My boot = and root = points to the same partition /dev/sda2 from lilo.conf boot=<boot-device> i.e. /dev/sda, not sda2. Please consult the man pages before using software. Regards, Thomas

1 0

FW: kernel panic
by Roelof Wobben 06 Oct '13

06 Oct '13

---------------------------------------- > From: rwobben(a)hotmail.com > To: fredrik(a)rinnestam.se > Subject: RE: kernel panic > Date: Sun, 6 Oct 2013 10:49:32 +0000 > > ---------------------------------------- >> Date: Sun, 6 Oct 2013 11:58:40 +0200 >> From: fredrik(a)rinnestam.se >> To: crux(a)lists.crux.nu >> Subject: Re: kernel panic >> >> On Sun, Oct 06, 2013 at 09:18:55AM +0000, Roelof Wobben wrote: >>> Hello, >>> >>> I now tried to install Crux 2.8 with ext4. >>> >>> So I enabled that in the menuconfig. >>> >>> After that a kernel panic. >>> >>> So I chrooted again and set all the missing parts enabled in the kernel. >>> >>> Did make all, cp arch/x86/boot/bzImage /boot/vmlinuz and cp System.map /boot/ >>> >>> And still a kernel panic with this message : >>> >>> kernel panic: not syncing: VFS : unable to mount root fson unknown block(8,2) >>> pid 1, comm: swapper/0 not tainted 3.5.4#2 >>> >> >> You are missing either 1) filesystem driver, 2) sata/ide/scsi controller >> driver, 3) scsi-disk I enabled the ext4 driver in the kernel I also enabled all this in the kernel: 80862e30 Yes Intel Corporation 4 Series Chipset DRAM Controller intel-agp 80862e31 Intel Corporation 4 Series Chipset PCI Express Root Port 808627d8 Yes Intel Corporation NM10/ICH7 Family High Definition Audio Controller snd-hda-intel v3.1.0- 808627d0 Intel Corporation NM10/ICH7 Family PCI Express Port 1 808627d2 Intel Corporation NM10/ICH7 Family PCI Express Port 2 808627c8 Intel Corporation NM10/ICH7 Family USB UHCI Controller #1 808627c9 Intel Corporation NM10/ICH7 Family USB UHCI Controller #2 808627ca Intel Corporation NM10/ICH7 Family USB UHCI Controller #3 808627cb Intel Corporation NM10/ICH7 Family USB UHCI Controller #4 808627cc Intel Corporation NM10/ICH7 Family USB2 EHCI Controller 8086244e Yes Intel Corporation 82801 PCI Bridge i810_rng 808627b8 Yes Intel Corporation 82801GB/GR (ICH7 Family) LPC Interface Bridge intel-rng,iTCO_wdt,leds-ss4200 v2.6.25- 808627df Yes Intel Corporation 82801G (ICH7 Family) IDE Controller ata_piix v2.6.25- 808627c0 Yes Intel Corporation NM10/ICH7 Family SATA Controller [IDE mode] ata_piix v2.6.25- 10de104a NVIDIA Corporation GF119 [GeForce GT 610] 10de0e08 NVIDIA Corporation GF119 HDMI Audio Controller 19691063 Yes Atheros Communications Inc. AR8131 Gigabit Ethernet atl1c v2.6.29- >> Or you have lilo incorrectly configured (trying to mount the wrong >> device). I also checked and lilo points to /dev/sda2 which is my root partition. Roelof

1 0

kernel panic
by Roelof Wobben 06 Oct '13

06 Oct '13

Hello, I now tried to install Crux 2.8 with ext4. So I enabled that in the menuconfig. After that a kernel panic. So I chrooted again and set all the missing parts enabled in the kernel. Did make all, cp arch/x86/boot/bzImage /boot/vmlinuz and cp System.map /boot/ And still a kernel panic with this message : kernel panic: not syncing: VFS : unable to mount root fson unknown block(8,2) pid 1, comm: swapper/0 not tainted 3.5.4#2 Roelof

2 1

Upgrade to 3.0 x86_64.
by Roelof Wobben 06 Oct '13

06 Oct '13

Hello, Is there a way I can make this upgrade without using a cd. So only use my internet connection ? Roelof

2 3