mirror of
git://slackware.nl/current.git
synced 2024-12-30 10:24:23 +01:00
837c3ac795
a/glibc-zoneinfo-2023b-noarch-1.txz: Upgraded.
This package provides the latest timezone updates.
a/libbytesize-2.8-x86_64-1.txz: Upgraded.
a/tar-1.34-x86_64-3.txz: Rebuilt.
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use
of uninitialized memory for a conditional jump. Exploitation to change the
flow of control has not been demonstrated. The issue occurs in from_header
in list.c via a V7 archive in which mtime has approximately 11 whitespace
characters.
Thanks to marav for the heads-up.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2022-48303
(* Security fix *)
ap/sqlite-3.41.2-x86_64-1.txz: Upgraded.
d/mercurial-6.4-x86_64-1.txz: Upgraded.
n/openvpn-2.6.2-x86_64-1.txz: Upgraded.
x/xorg-server-xwayland-23.1.0-x86_64-1.txz: Upgraded.
31 lines
986 B
Diff
31 lines
986 B
Diff
From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com>
|
|
Date: Wed, 11 Jan 2023 08:55:58 +0100
|
|
Subject: [PATCH] Fix savannah bug #62387
|
|
|
|
* src/list.c (from_header): Check for the end of field after leading byte
|
|
(0x80 or 0xff) of base-256 encoded header value
|
|
---
|
|
src/list.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/src/list.c b/src/list.c
|
|
index 9fafc425..bf41b581 100644
|
|
--- a/src/list.c
|
|
+++ b/src/list.c
|
|
@@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type,
|
|
<< (CHAR_BIT * sizeof (uintmax_t)
|
|
- LG_256 - (LG_256 - 2)));
|
|
value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit;
|
|
+ if (where == lim)
|
|
+ {
|
|
+ if (type && !silent)
|
|
+ ERROR ((0, 0, _("Archive base-256 value is invalid")));
|
|
+ return -1;
|
|
+ }
|
|
for (;;)
|
|
{
|
|
value = (value << LG_256) + (unsigned char) *where++;
|
|
--
|
|
2.38.1
|
|
|