diff options
| author | Ariadne Conill <ariadne@dereferenced.org> | 2021-06-22 06:39:45 -0600 |
|---|---|---|
| committer | Ariadne Conill <ariadne@dereferenced.org> | 2021-06-22 06:42:03 -0600 |
| commit | 41f154cbb278d2153108e922403a2492fa64e37e (patch) | |
| tree | c6d3597efe27b17dbe8ad75638c018149a2cf6ce | |
| parent | 8232ba5e9dac1cfc5b686199f1e81da2a128b739 (diff) | |
main/unzip: add mitigation for CVE-2018-18384 (incomplete fix of CVE-2014-9913)
| -rw-r--r-- | main/unzip/APKBUILD | 12 | ||||
| -rw-r--r-- | main/unzip/CVE-2018-18384.patch | 13 |
2 files changed, 22 insertions, 3 deletions
diff --git a/main/unzip/APKBUILD b/main/unzip/APKBUILD index 2fad42a7b49..4728573ff2f 100644 --- a/main/unzip/APKBUILD +++ b/main/unzip/APKBUILD @@ -3,7 +3,7 @@ pkgname=unzip pkgver=6.0 _pkgver=${pkgver//./} -pkgrel=8 +pkgrel=9 pkgdesc="Extract PKZIP-compatible .zip files" url="http://www.info-zip.org/UnZip.html" arch="all" @@ -23,10 +23,13 @@ source="https://dev.alpinelinux.org/archive/unzip/unzip$_pkgver.tgz CVE-2018-1000035.patch fix-CVE-2014-8139.patch CVE-2019-13232.patch + CVE-2018-18384.patch " builddir="$srcdir/$pkgname$_pkgver" # secfixes: +# 6.0-r9: +# - CVE-2018-18384 # 6.0-r7: # - CVE-2019-13232 # 6.0-r3: @@ -56,7 +59,8 @@ package() { "$pkgdir"/usr/share/licenses/$pkgname/LICENSE } -sha512sums="0694e403ebc57b37218e00ec1a406cae5cc9c5b52b6798e0d4590840b6cdbf9ddc0d9471f67af783e960f8fa2e620394d51384257dca23d06bcd90224a80ce5d unzip60.tgz +sha512sums=" +0694e403ebc57b37218e00ec1a406cae5cc9c5b52b6798e0d4590840b6cdbf9ddc0d9471f67af783e960f8fa2e620394d51384257dca23d06bcd90224a80ce5d unzip60.tgz 9d2914f22fb0075a2b6f72825c235f46eafd8d47b6fb6fcc8303fc69336e256b15923c002d2615bb6af733344c2315e4a8504d77bae301e10c11d4736faa2c81 10-unzip-handle-pkware-verify.patch 57699582e9056af0817dcb67f8db67e6a1ff8208c137fbebcf559429e5f12b471b75d7e1ef938e5bbb5416074a51ac7342e4ce8057f4bbdcb0bf079b8d7832af 20-unzip-uidgid-fix.patch b0b745cff474756447e699a13ff003871b33a4f7a24a91150e5a947eba5132fd90fbacf7580379fc13c5f638483b25cbc226f85b9cac9c7662b2f91927eb2bb3 unzip-6.0-heap-overflow-infloop.patch @@ -67,4 +71,6 @@ b0b745cff474756447e699a13ff003871b33a4f7a24a91150e5a947eba5132fd90fbacf7580379fc 8c4a4313072ff0d87eadb0f5472eb48f2802b835dd282305811a96de87a41fed48be60fbdd434e6b6359418f0559f7793deaa1d68161a0c0ead9f8574bb9f14c CVE-2016-9844.patch 6f757385a23fe6a034f676df6bf233243afa8743761e3d715e532d066fcd7dc8f8dcd6192be693258f3855837e5534490784378768abe7ce710fb869258d49b7 CVE-2018-1000035.patch 13f9c54fcdde478c4afe391c8e7ef9c31b03228aaace5da38382612951cbfd60710fd3d931569297953be32b2c5906715aed4b1c05e28cc8fccbb27f38b57550 fix-CVE-2014-8139.patch -d11758bda3b022f1adb4031bfbc770c6391e3470f3126ec5a4d3d2800d5452245eee26256f539d60adee33f01ba8ba8345299736cd9568da1242f6f739e4a598 CVE-2019-13232.patch" +d11758bda3b022f1adb4031bfbc770c6391e3470f3126ec5a4d3d2800d5452245eee26256f539d60adee33f01ba8ba8345299736cd9568da1242f6f739e4a598 CVE-2019-13232.patch +1edd66fbca3cfbfad7b19db0b1564b93f13b27b10ff157cf9907228184b56f1f4c87c2dd2a09afc1307ee86622f3aaeea46f8336c249249c8452304cf4d25272 CVE-2018-18384.patch +" diff --git a/main/unzip/CVE-2018-18384.patch b/main/unzip/CVE-2018-18384.patch new file mode 100644 index 00000000000..ad28f8c4994 --- /dev/null +++ b/main/unzip/CVE-2018-18384.patch @@ -0,0 +1,13 @@ +diff --git a/list.c b/list.c +index f7359c3..4c3d703 100644 +--- a/list.c ++++ b/list.c +@@ -97,7 +97,7 @@ int list_files(__G) /* return PK-type error code */ + { + int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL; + #ifndef WINDLL +- char sgn, cfactorstr[10]; ++ char sgn, cfactorstr[13]; + int longhdr=(uO.vflag>1); + #endif + int date_format; |