February 2015 - CRUX - lists.crux.nu

ports/core (3.1): [notify] unzip: added patch for CVE-2014-9636
by crux＠crux.nu 07 Feb '15

07 Feb '15

commit cbb0e06bee31031a76f3061d380467c5d1c4f1d8 Author: Fredrik Rinnestam <fredrik(a)crux.nu> Date: Sat Feb 7 20:29:29 2015 +0100 [notify] unzip: added patch for CVE-2014-9636 diff --git a/unzip/.md5sum b/unzip/.md5sum index 26776c5..e5857a4 100644 --- a/unzip/.md5sum +++ b/unzip/.md5sum @@ -1 +1,3 @@ +19341ef8810558e0cb4e3fe25b3eff70 unzip-6.0-attribs-overflow.patch +40ae64ba09670480195539bcdf92c0ef unzip-6.0-overflow.patch 62b490407489521db863b523a7f86375 unzip60.tar.gz diff --git a/unzip/Pkgfile b/unzip/Pkgfile index c2b8efb..68e66a3 100644 --- a/unzip/Pkgfile +++ b/unzip/Pkgfile @@ -4,11 +4,14 @@ name=unzip version=6.0 -release=2 -source=(http://downloads.sourceforge.net/sourceforge/infozip/${name}${version//./}.tar.gz) +release=3 +source=(http://downloads.sourceforge.net/sourceforge/infozip/${name}${version//./}.tar.gz \ + unzip-6.0-overflow.patch unzip-6.0-attribs-overflow.patch) build() { cd ${name}${version//./} + patch -p1 -i $SRC/unzip-6.0-overflow.patch + patch -p1 -i $SRC/unzip-6.0-attribs-overflow.patch make -f unix/Makefile LOCAL_UNZIP="$CFLAGS" prefix=/usr linux_noasm make -f unix/Makefile prefix=$PKG/usr install ln -sf unzip $PKG/usr/bin/zipinfo diff --git a/unzip/unzip-6.0-attribs-overflow.patch b/unzip/unzip-6.0-attribs-overflow.patch new file mode 100644 index 0000000..3122325 --- /dev/null +++ b/unzip/unzip-6.0-attribs-overflow.patch @@ -0,0 +1,12 @@ +diff -up unzip60/zipinfo.c.attribs-overflow unzip60/zipinfo.c +--- unzip60/zipinfo.c.attribs-overflow 2009-11-30 09:55:39.000000000 +0100 ++++ unzip60/zipinfo.c 2009-11-30 09:56:42.844263244 +0100 +@@ -1881,7 +1881,7 @@ static int zi_short(__G) /* return PK- + #endif + int k, error, error_in_archive=PK_COOL; + unsigned hostnum, hostver, methid, methnum, xattr; +- char *p, workspace[12], attribs[16]; ++ char *p, workspace[12], attribs[17]; + char methbuf[5]; + static ZCONST char dtype[5]="NXFS"; /* normal, maximum, fast, superfast */ + static ZCONST char Far os[NUM_HOSTS+1][4] = { diff --git a/unzip/unzip-6.0-overflow.patch b/unzip/unzip-6.0-overflow.patch new file mode 100644 index 0000000..1750796 --- /dev/null +++ b/unzip/unzip-6.0-overflow.patch @@ -0,0 +1,27 @@ +diff --git a/extract.c b/extract.c +index a0a4929..9ef80b3 100644 +--- a/extract.c ++++ b/extract.c +@@ -2214,6 +2214,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata) + ulg eb_ucsize; + uch *eb_ucptr; + int r; ++ ush method; + + if (compr_offset < 4) /* field is not compressed: */ + return PK_OK; /* do nothing and signal OK */ +@@ -2223,6 +2224,12 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata) + eb_size <= (compr_offset + EB_CMPRHEADLEN))) + return IZ_EF_TRUNC; /* no compressed data! */ + ++ method = makeword(eb + (EB_HEADSIZE + compr_offset)); ++ if ((method == STORED) && (eb_size - compr_offset != eb_ucsize)) ++ return PK_ERR; /* compressed & uncompressed ++ * should match in STORED ++ * method */ ++ + if ( + #ifdef INT_16BIT + (((ulg)(extent)eb_ucsize) != eb_ucsize) || + +

1 0

ports/opt (3.1): [notify] flash-player-plugin: updated to 11.2.202.442
by crux＠crux.nu 05 Feb '15

05 Feb '15

commit 7838b6f7c4fa70762db94a9fb6097370a03f65ed Author: Jose V Beneyto <jose.beneyto(a)eslife.es> Date: Thu Feb 5 23:22:08 2015 +0000 [notify] flash-player-plugin: updated to 11.2.202.442 Security update: http://helpx.adobe.com/security/products/flash-player/apsb15-04.html diff --git a/flash-player-plugin/.md5sum b/flash-player-plugin/.md5sum index d4a06ae..1261f18 100644 --- a/flash-player-plugin/.md5sum +++ b/flash-player-plugin/.md5sum @@ -1 +1 @@ -ac463802bcb18d2fb3e0eea9c2542679 flash-plugin-11.2.202.440-release.x86_64.rpm +d3ff0ba992207808cf42f152383d44b2 flash-plugin-11.2.202.442-release.x86_64.rpm diff --git a/flash-player-plugin/Pkgfile b/flash-player-plugin/Pkgfile index f2cf9d1..0bcb5c3 100644 --- a/flash-player-plugin/Pkgfile +++ b/flash-player-plugin/Pkgfile @@ -5,7 +5,7 @@ # Depends on: name=flash-player-plugin -version=11.2.202.440 +version=11.2.202.442 release=1 source=(http://fpdownload.macromedia.com/get/flashplayer/pdc/$version/flash…

1 0

ports/opt (3.1): [notify] chromium: updated to 40.0.2214.94
by crux＠crux.nu 04 Feb '15

04 Feb '15

commit c507741f0aebee2e52465e9c016bd1732bd02ba1 Author: Jose V Beneyto <jose.beneyto(a)eslife.es> Date: Wed Feb 4 20:08:00 2015 +0000 [notify] chromium: updated to 40.0.2214.94 This release contains a Flash Player update. This update contains some fixes: https://chromium.googlesource.com/chromium/src/+log/40.0.2214.93..40.0.2214… diff --git a/chromium/.footprint b/chromium/.footprint index cf95f59..ea6a61d 100644 --- a/chromium/.footprint +++ b/chromium/.footprint @@ -27,6 +27,9 @@ drwxr-xr-x root/root usr/lib/chromium/resources/inspector/Images/ -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/checker.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeDisabledSelect.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeDisabledSelect_2x.png +-rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeLeft.png +-rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeMiddle.png +-rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeRight.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeSelect.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/chromeSelect_2x.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/cookie.png @@ -87,74 +90,31 @@ drwxr-xr-x root/root usr/lib/chromium/resources/inspector/Images/ -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/transformControls.png -rw-rw-r-- root/root usr/lib/chromium/resources/inspector/Images/transformControls_2x.png -rw-r--r-- root/root usr/lib/chromium/resources/inspector/InspectorBackendCommands.js --rw-r--r-- root/root usr/lib/chromium/resources/inspector/Runtime.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/SupportedCSSProperties.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/accelerometer.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/auditsPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/audits_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/breakpointsList.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/canvasProfiler.css -drwxr-xr-x root/root usr/lib/chromium/resources/inspector/cm/ --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/cm/codemirror.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/cmdevtools.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/console_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/dataGrid.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/devicesView.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/devices_module.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/devtools.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/devtools.html -rw-r--r-- root/root usr/lib/chromium/resources/inspector/devtools.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/devtools_extension_api.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/documentationView.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/documentation_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/elementsPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/elements_module.js --rw-r--r-- root/root usr/lib/chromium/resources/inspector/extensions_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/filter.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/filteredItemSelectionDialog.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/flameChart.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/heapProfiler.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/heap_snapshot_worker_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/helpScreen.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/indexedDBViews.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/inspectorCommon.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/inspectorSyntaxHighlight.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/layersPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/layers_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/navigatorView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/networkLogView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/networkPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/network_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/overrides.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/overviewGrid.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/panelEnablerView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/pieChart.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/profiler_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/profilesPanel.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/promisesPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/promises_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/requestCookiesView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/requestHeadersView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/resourceView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/resourcesPanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/resources_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/responsiveDesignView.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/revisionHistory.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/screencastView.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/script_formatter_worker_module.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/settings_module.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/source_frame_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/sourcesPanel.css --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/sourcesView.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/sources_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/spectrum.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/temp_storage_shared_worker_module.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/timelinePanel.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/timeline_module.js -rw-r--r-- root/root usr/lib/chromium/resources/inspector/toolbox.css -rw-r--r-- root/root usr/lib/chromium/resources/inspector/toolbox.html -rw-r--r-- root/root usr/lib/chromium/resources/inspector/toolbox.js --rw-rw-r-- root/root usr/lib/chromium/resources/inspector/webSocketFrameView.css drwxr-xr-x root/root usr/man/ drwxr-xr-x root/root usr/man/man1/ -rw-r--r-- root/root usr/man/man1/chromium.1.gz diff --git a/chromium/.md5sum b/chromium/.md5sum index 56918fe..7603108 100644 --- a/chromium/.md5sum +++ b/chromium/.md5sum @@ -1,2 +1,2 @@ -9ecb9007ca7d97d8053e63bd1f381f3f chromium-39.0.2171.95.tar.xz +67d25ab2c714621e6c250ed5f5c444c0 chromium-40.0.2214.94.tar.xz 64968626706b07721983ac59fb3babbf chromium.sh diff --git a/chromium/Pkgfile b/chromium/Pkgfile index 67310de..2aaafcb 100644 --- a/chromium/Pkgfile +++ b/chromium/Pkgfile @@ -5,7 +5,7 @@ # Depends on: ninja dbus-glib gtk libevent nss xorg-libxscrnsaver xorg-libxtst libgcrypt xorg-libxdamage yasm xorg-libxt gperf speech-dispatcher libdrm libexif clang name=chromium -version=39.0.2171.95 +version=40.0.2214.94 release=1 source=(http://commondatastorage.googleapis.com/chromium-browser-official/$… \ $name.sh)

1 0

ports/core (3.0): [notify] glibc-32: fix CVE-2015-0235 ghost vulnerability in 3.0, too
by crux＠crux.nu 04 Feb '15

04 Feb '15

commit 49eb9abe3d36661758aab4d077ae927cdf428a3b Author: Thomas Penteker <tek(a)serverop.de> Date: Wed Feb 4 20:32:09 2015 +0100 [notify] glibc-32: fix CVE-2015-0235 ghost vulnerability in 3.0, too diff --git a/glibc-32/.md5sum b/glibc-32/.md5sum index a0c2384..63270c0 100644 --- a/glibc-32/.md5sum +++ b/glibc-32/.md5sum @@ -1,6 +1,7 @@ 80b181b02ab249524ec92822c0174cf7 glibc-2.16.0.tar.xz c3f3499e0a6272cba7b6e46bfe6bbcea glibc-32-2.16.0-multilib-dirs.patch 3a51662cd99783b3d01ceac2dca19597 glibc-CVE-2013-4332.patch +1168de0dd6aeca3e85a992e4ffaf53d5 glibc-ghost-CVE-2015-0235.patch d4a2a19efe1e9b59b86fd15a968f7e10 glibc-regexp_buffer_overrun.patch 7e6a5a13c37f93213db9803d9790b7de glibc-resolv_assert.patch 99ed7b88221475d51a073f00d7ee9c42 glibc-segfault_in_strncasecmp.patch diff --git a/glibc-32/Pkgfile b/glibc-32/Pkgfile index f0f78f9..955bf23 100644 --- a/glibc-32/Pkgfile +++ b/glibc-32/Pkgfile @@ -4,7 +4,7 @@ name=glibc-32 version=2.16.0 -release=6 +release=7 source=(http://ftp.gnu.org/gnu/glibc/glibc-$version.tar.xz \ http://crux.nu/files/distfiles/kernel-headers-3.4.11.tar.xz \ $name-$version-multilib-dirs.patch \ @@ -14,6 +14,7 @@ source=(http://ftp.gnu.org/gnu/glibc/glibc-$version.tar.xz \ glibc-segfault_in_strncasecmp.patch \ glibc-strtod_integer_overflow.patch \ glibc-regexp_buffer_overrun.patch + glibc-ghost-CVE-2015-0235.patch \ glibc-CVE-2013-4332.patch) build() { @@ -28,6 +29,7 @@ build() { patch -p1 -d glibc-$version -i $SRC/glibc-regexp_buffer_overrun.patch patch -p1 -d glibc-$version -i $SRC/$name-$version-multilib-dirs.patch patch -p1 -d glibc-$version -i $SRC/glibc-CVE-2013-4332.patch + patch -p1 -d glibc-$version -i $SRC/glibc-ghost-CVE-2015-0235.patch mkdir build cd build diff --git a/glibc-32/glibc-ghost-CVE-2015-0235.patch b/glibc-32/glibc-ghost-CVE-2015-0235.patch new file mode 100644 index 0000000..b1b49d0 --- /dev/null +++ b/glibc-32/glibc-ghost-CVE-2015-0235.patch @@ -0,0 +1,212 @@ +diff -Naur glibc-2.16.0/nss/digits_dots.c glibc-2.16.0.new/nss/digits_dots.c +--- glibc-2.16.0/nss/digits_dots.c 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/digits_dots.c 2015-01-28 13:45:05.481023654 +0100 +@@ -46,7 +46,10 @@ + { + if (h_errnop) + *h_errnop = NETDB_INTERNAL; +- *result = NULL; ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_TRYAGAIN; ++ else ++ *result = NULL; + return -1; + } + +@@ -83,14 +86,16 @@ + } + + size_needed = (sizeof (*host_addr) +- + sizeof (*h_addr_ptrs) + strlen (name) + 1); ++ + sizeof (*h_addr_ptrs) ++ + sizeof (*h_alias_ptr) + strlen (name) + 1); + + if (buffer_size == NULL) + { + if (buflen < size_needed) + { ++ *status = NSS_STATUS_TRYAGAIN; + if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; ++ *h_errnop = NETDB_INTERNAL; + __set_errno (ERANGE); + goto done; + } +@@ -109,7 +114,7 @@ + *buffer_size = 0; + __set_errno (save); + if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; ++ *h_errnop = NETDB_INTERNAL; + *result = NULL; + goto done; + } +@@ -149,7 +154,9 @@ + if (! ok) + { + *h_errnop = HOST_NOT_FOUND; +- if (buffer_size) ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else + *result = NULL; + goto done; + } +@@ -190,7 +197,7 @@ + if (buffer_size == NULL) + *status = NSS_STATUS_SUCCESS; + else +- *result = resbuf; ++ *result = resbuf; + goto done; + } + +@@ -201,15 +208,6 @@ + + if ((isxdigit (name[0]) && strchr (name, ':') != NULL) || name[0] == ':') + { +- const char *cp; +- char *hostname; +- typedef unsigned char host_addr_t[16]; +- host_addr_t *host_addr; +- typedef char *host_addr_list_t[2]; +- host_addr_list_t *h_addr_ptrs; +- size_t size_needed; +- int addr_size; +- + switch (af) + { + default: +@@ -225,7 +223,10 @@ + /* This is not possible. We cannot represent an IPv6 address + in an `struct in_addr' variable. */ + *h_errnop = HOST_NOT_FOUND; +- *result = NULL; ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else ++ *result = NULL; + goto done; + + case AF_INET6: +@@ -233,42 +234,6 @@ + break; + } + +- size_needed = (sizeof (*host_addr) +- + sizeof (*h_addr_ptrs) + strlen (name) + 1); +- +- if (buffer_size == NULL && buflen < size_needed) +- { +- if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; +- __set_errno (ERANGE); +- goto done; +- } +- else if (buffer_size != NULL && *buffer_size < size_needed) +- { +- char *new_buf; +- *buffer_size = size_needed; +- new_buf = realloc (*buffer, *buffer_size); +- +- if (new_buf == NULL) +- { +- save = errno; +- free (*buffer); +- __set_errno (save); +- *buffer = NULL; +- *buffer_size = 0; +- *result = NULL; +- goto done; +- } +- *buffer = new_buf; +- } +- +- memset (*buffer, '\0', size_needed); +- +- host_addr = (host_addr_t *) *buffer; +- h_addr_ptrs = (host_addr_list_t *) +- ((char *) host_addr + sizeof (*host_addr)); +- hostname = (char *) h_addr_ptrs + sizeof (*h_addr_ptrs); +- + for (cp = name;; ++cp) + { + if (!*cp) +@@ -281,7 +246,9 @@ + if (inet_pton (AF_INET6, name, host_addr) <= 0) + { + *h_errnop = HOST_NOT_FOUND; +- if (buffer_size) ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else + *result = NULL; + goto done; + } +diff -Naur glibc-2.16.0/nss/getXXbyYY_r.c glibc-2.16.0.new/nss/getXXbyYY_r.c +--- glibc-2.16.0/nss/getXXbyYY_r.c 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/getXXbyYY_r.c 2015-01-28 13:45:05.482023654 +0100 +@@ -179,6 +179,9 @@ + case -1: + return errno; + case 1: ++#ifdef NEED_H_ERRNO ++ any_service = true; ++#endif + goto done; + } + #endif +diff -Naur glibc-2.16.0/nss/Makefile glibc-2.16.0.new/nss/Makefile +--- glibc-2.16.0/nss/Makefile 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/Makefile 2015-01-28 13:52:01.367041544 +0100 +@@ -38,7 +38,7 @@ + makedb-modules = xmalloc hash-string + extra-objs += $(makedb-modules:=.o) + +-tests = test-netdb tst-nss-test1 ++tests = test-netdb tst-nss-test1 test-digits-dots + xtests = bug-erange + + include ../Makeconfig +diff -Naur glibc-2.16.0/nss/test-digits-dots.c glibc-2.16.0.new/nss/test-digits-dots.c +--- glibc-2.16.0/nss/test-digits-dots.c 1970-01-01 01:00:00.000000000 +0100 ++++ glibc-2.16.0.new/nss/test-digits-dots.c 2015-01-28 13:45:05.483023654 +0100 +@@ -0,0 +1,38 @@ ++/* Copyright (C) 2013 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <http://www.gnu.org/licenses/>. */ ++ ++/* Testcase for BZ #15014 */ ++ ++#include <stdlib.h> ++#include <netdb.h> ++#include <errno.h> ++ ++static int ++do_test (void) ++{ ++ char buf[32]; ++ struct hostent *result = NULL; ++ struct hostent ret; ++ int h_err = 0; ++ int err; ++ ++ err = gethostbyname_r ("1.2.3.4", &ret, buf, sizeof (buf), &result, &h_err); ++ return err == ERANGE && h_err == NETDB_INTERNAL ? EXIT_SUCCESS : EXIT_FAILURE; ++} ++ ++#define TEST_FUNCTION do_test () ++#include "../test-skeleton.c" diff --git a/glibc/glibc-ghost-CVE-2015-0235.patch b/glibc/glibc-ghost-CVE-2015-0235.patch new file mode 100644 index 0000000..b1b49d0 --- /dev/null +++ b/glibc/glibc-ghost-CVE-2015-0235.patch @@ -0,0 +1,212 @@ +diff -Naur glibc-2.16.0/nss/digits_dots.c glibc-2.16.0.new/nss/digits_dots.c +--- glibc-2.16.0/nss/digits_dots.c 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/digits_dots.c 2015-01-28 13:45:05.481023654 +0100 +@@ -46,7 +46,10 @@ + { + if (h_errnop) + *h_errnop = NETDB_INTERNAL; +- *result = NULL; ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_TRYAGAIN; ++ else ++ *result = NULL; + return -1; + } + +@@ -83,14 +86,16 @@ + } + + size_needed = (sizeof (*host_addr) +- + sizeof (*h_addr_ptrs) + strlen (name) + 1); ++ + sizeof (*h_addr_ptrs) ++ + sizeof (*h_alias_ptr) + strlen (name) + 1); + + if (buffer_size == NULL) + { + if (buflen < size_needed) + { ++ *status = NSS_STATUS_TRYAGAIN; + if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; ++ *h_errnop = NETDB_INTERNAL; + __set_errno (ERANGE); + goto done; + } +@@ -109,7 +114,7 @@ + *buffer_size = 0; + __set_errno (save); + if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; ++ *h_errnop = NETDB_INTERNAL; + *result = NULL; + goto done; + } +@@ -149,7 +154,9 @@ + if (! ok) + { + *h_errnop = HOST_NOT_FOUND; +- if (buffer_size) ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else + *result = NULL; + goto done; + } +@@ -190,7 +197,7 @@ + if (buffer_size == NULL) + *status = NSS_STATUS_SUCCESS; + else +- *result = resbuf; ++ *result = resbuf; + goto done; + } + +@@ -201,15 +208,6 @@ + + if ((isxdigit (name[0]) && strchr (name, ':') != NULL) || name[0] == ':') + { +- const char *cp; +- char *hostname; +- typedef unsigned char host_addr_t[16]; +- host_addr_t *host_addr; +- typedef char *host_addr_list_t[2]; +- host_addr_list_t *h_addr_ptrs; +- size_t size_needed; +- int addr_size; +- + switch (af) + { + default: +@@ -225,7 +223,10 @@ + /* This is not possible. We cannot represent an IPv6 address + in an `struct in_addr' variable. */ + *h_errnop = HOST_NOT_FOUND; +- *result = NULL; ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else ++ *result = NULL; + goto done; + + case AF_INET6: +@@ -233,42 +234,6 @@ + break; + } + +- size_needed = (sizeof (*host_addr) +- + sizeof (*h_addr_ptrs) + strlen (name) + 1); +- +- if (buffer_size == NULL && buflen < size_needed) +- { +- if (h_errnop != NULL) +- *h_errnop = TRY_AGAIN; +- __set_errno (ERANGE); +- goto done; +- } +- else if (buffer_size != NULL && *buffer_size < size_needed) +- { +- char *new_buf; +- *buffer_size = size_needed; +- new_buf = realloc (*buffer, *buffer_size); +- +- if (new_buf == NULL) +- { +- save = errno; +- free (*buffer); +- __set_errno (save); +- *buffer = NULL; +- *buffer_size = 0; +- *result = NULL; +- goto done; +- } +- *buffer = new_buf; +- } +- +- memset (*buffer, '\0', size_needed); +- +- host_addr = (host_addr_t *) *buffer; +- h_addr_ptrs = (host_addr_list_t *) +- ((char *) host_addr + sizeof (*host_addr)); +- hostname = (char *) h_addr_ptrs + sizeof (*h_addr_ptrs); +- + for (cp = name;; ++cp) + { + if (!*cp) +@@ -281,7 +246,9 @@ + if (inet_pton (AF_INET6, name, host_addr) <= 0) + { + *h_errnop = HOST_NOT_FOUND; +- if (buffer_size) ++ if (buffer_size == NULL) ++ *status = NSS_STATUS_NOTFOUND; ++ else + *result = NULL; + goto done; + } +diff -Naur glibc-2.16.0/nss/getXXbyYY_r.c glibc-2.16.0.new/nss/getXXbyYY_r.c +--- glibc-2.16.0/nss/getXXbyYY_r.c 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/getXXbyYY_r.c 2015-01-28 13:45:05.482023654 +0100 +@@ -179,6 +179,9 @@ + case -1: + return errno; + case 1: ++#ifdef NEED_H_ERRNO ++ any_service = true; ++#endif + goto done; + } + #endif +diff -Naur glibc-2.16.0/nss/Makefile glibc-2.16.0.new/nss/Makefile +--- glibc-2.16.0/nss/Makefile 2012-06-30 21:12:34.000000000 +0200 ++++ glibc-2.16.0.new/nss/Makefile 2015-01-28 13:52:01.367041544 +0100 +@@ -38,7 +38,7 @@ + makedb-modules = xmalloc hash-string + extra-objs += $(makedb-modules:=.o) + +-tests = test-netdb tst-nss-test1 ++tests = test-netdb tst-nss-test1 test-digits-dots + xtests = bug-erange + + include ../Makeconfig +diff -Naur glibc-2.16.0/nss/test-digits-dots.c glibc-2.16.0.new/nss/test-digits-dots.c +--- glibc-2.16.0/nss/test-digits-dots.c 1970-01-01 01:00:00.000000000 +0100 ++++ glibc-2.16.0.new/nss/test-digits-dots.c 2015-01-28 13:45:05.483023654 +0100 +@@ -0,0 +1,38 @@ ++/* Copyright (C) 2013 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ <http://www.gnu.org/licenses/>. */ ++ ++/* Testcase for BZ #15014 */ ++ ++#include <stdlib.h> ++#include <netdb.h> ++#include <errno.h> ++ ++static int ++do_test (void) ++{ ++ char buf[32]; ++ struct hostent *result = NULL; ++ struct hostent ret; ++ int h_err = 0; ++ int err; ++ ++ err = gethostbyname_r ("1.2.3.4", &ret, buf, sizeof (buf), &result, &h_err); ++ return err == ERANGE && h_err == NETDB_INTERNAL ? EXIT_SUCCESS : EXIT_FAILURE; ++} ++ ++#define TEST_FUNCTION do_test () ++#include "../test-skeleton.c"

1 0

ports/core (3.0): [notify] glibc: fix CVE-2015-0235 ghost vulnerability in 3.0, too
by crux＠crux.nu 04 Feb '15

04 Feb '15

commit 5614803c3ed675c3750cf05ea34a4679871ec01a Author: Thomas Penteker <tek(a)serverop.de> Date: Wed Feb 4 20:27:53 2015 +0100 [notify] glibc: fix CVE-2015-0235 ghost vulnerability in 3.0, too diff --git a/glibc/.md5sum b/glibc/.md5sum index 3ee8978..456cc87 100644 --- a/glibc/.md5sum +++ b/glibc/.md5sum @@ -1,6 +1,7 @@ 3402b18f924954aa68d1d59ed378545f glibc-2.16.0-multilib-dirs.patch 80b181b02ab249524ec92822c0174cf7 glibc-2.16.0.tar.xz 3a51662cd99783b3d01ceac2dca19597 glibc-CVE-2013-4332.patch +1168de0dd6aeca3e85a992e4ffaf53d5 glibc-ghost-CVE-2015-0235.patch d4a2a19efe1e9b59b86fd15a968f7e10 glibc-regexp_buffer_overrun.patch 7e6a5a13c37f93213db9803d9790b7de glibc-resolv_assert.patch 99ed7b88221475d51a073f00d7ee9c42 glibc-segfault_in_strncasecmp.patch diff --git a/glibc/Pkgfile b/glibc/Pkgfile index 0ec459d..768946f 100644 --- a/glibc/Pkgfile +++ b/glibc/Pkgfile @@ -4,7 +4,7 @@ name=glibc version=2.16.0 -release=5 +release=6 source=(http://ftp.gnu.org/gnu/glibc/glibc-$version.tar.xz \ http://crux.nu/files/distfiles/kernel-headers-3.4.11.tar.xz \ $name-$version-multilib-dirs.patch \ @@ -13,6 +13,7 @@ source=(http://ftp.gnu.org/gnu/glibc/glibc-$version.tar.xz \ $name-segfault_in_strncasecmp.patch \ $name-strtod_integer_overflow.patch \ $name-regexp_buffer_overrun.patch \ + $name-ghost-CVE-2015-0235.patch \ $name-CVE-2013-4332.patch) build() { @@ -27,6 +28,7 @@ build() { patch -p1 -d $name-$version -i $SRC/$name-regexp_buffer_overrun.patch patch -p1 -d $name-$version -i $SRC/$name-$version-multilib-dirs.patch patch -p1 -d $name-$version -i $SRC/$name-CVE-2013-4332.patch + patch -p1 -d $name-$version -i $SRC/$name-ghost-CVE-2015-0235.patch mkdir build cd build

1 0

how to put iso on USB drive
by Wawrzek Niewodniczanski 03 Feb '15

03 Feb '15

Hi, Sorry for rather silly question, but I haven't had a lot of experience in installing desktop Linux lately. I stopped on CD phase, USB is something new for me. So could you please advice how to put Crux iso on USB stick? Is dd OK? Maybe: dd if=crux-3.1.iso of=/dev/sdb bs=4K Or do I need to mount iso and copy content of create partition? Thanks, Wawrzek -- Dr Wawrzyniec Niewodniczański or Wawrzek for short PhD in Quantum Chemistry & MSc in Molecular Engineering WWW: http://wawrzek.name E-MAIL: jobs(a)wawrzek.name Linux User #177124

2 1

updating exim fails
by Cezar Rangel 02 Feb '15

02 Feb '15

when I run #prt-get sysup in the end exim does not update. trying to update it I get: syst...done > pwd...done type I ... done > cwd (1) /pub/exim/exim4...done size exim-4.84.tar.bz2...done pasv...done > retr exim-4.84.tar.bz2 ... no such file `exim-4.84.tar.bz2` error downloading `ftp://ftp.exim.org/pub/exim/exim4/exim-4.84.tar.bz2` failed packages where update failed exim

3 4

pulseaudio fails
by Cezar Rangel 02 Feb '15

02 Feb '15

I am trying to run pulseaudio but if fails: bash-4.3$ pulseaudio --start E: [pulseaudio] main.c: Daemon startup failed. bash-4.3$ I have chosen pulseaudio because I did not manage to configure sound with alsaconf: my sound device is onboard: bash-4.3# lspci | grep Audio 00:14.2 Audio device: Advanced Micro Devices, Inc. [AMD/ATI] SBx00 Azalia (Intel HDA) 01:00.1 Audio device: NVIDIA Corporation GF108 High Definition Audio Controller (rev a1) bash-4.3#

3 5

contrib/x265: url broken
by Alexander Kozlov 02 Feb '15

02 Feb '15

url and md5sum fail, should be -source=(https://bitbucket.org/multicoreware/x265/get/$version.tar.bz2) +source=(https://bitbucket.org/multicoreware/x265/get/$name-$version.tar.bz2) Best, Alex.

2 1

grub and kernel panic
by Cezar Rangel 01 Feb '15

01 Feb '15

hi. I am trying to boot crux using the menuentry of the grub of another distro. both the distro and its grub are installed on /dev/sda (crux is installed on /dev/sde). all the other menuentries manage to boot the distros they refer to. However, when I try to boot crux I get a kernel panic. I must remark that If I boot crux with the installation media I can boot without any problem. *menuentry 'crux 3.1 (on /dev/sde1)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-3.12.24-$ insmod part_msdos insmod ext2 set root='hd4,msdos1' if [ x$feature_platform_search_hint = xy ]; then search --no-floppy --fs-uuid --set=root --hint-bios=hd4,msdos1 --hint-efi=hd4,msdos1 --hint-baremetal=ahci4,msdos1 98ece8d4-ef04-48a6-a58e-c654314* *67f1f else search --no-floppy --fs-uuid --set=root 98ece8d4-ef04-48a6-a58e-c65431467f1f fi linux /boot/vmlinuz-3.12.24 root=/dev/sde1 }}* *### END /etc/grub.d/30_os-prober ###*I wonder if there is any changes I have to make on crux system to help it be booted this way. Besides If I install crux grub/lilo will it recognize the other distros I have on the other disks on this machine? And third I think if I decide to install crux grub/lilo it will have to be installed on /dev/sda(mbr). Or maybe I should change the boot order on bios (to boot /dev/sde in first place) and install it on /dev/sde. but I wonder if the other disks will be recognized and booted. *thanks for your attention*

3 5