aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAriadne Conill <ariadne@dereferenced.org>2021-06-22 06:39:45 -0600
committerAriadne Conill <ariadne@dereferenced.org>2021-06-22 06:42:03 -0600
commit41f154cbb278d2153108e922403a2492fa64e37e (patch)
treec6d3597efe27b17dbe8ad75638c018149a2cf6ce
parent8232ba5e9dac1cfc5b686199f1e81da2a128b739 (diff)
downloadaports-41f154cbb278d2153108e922403a2492fa64e37e.tar.gz
aports-41f154cbb278d2153108e922403a2492fa64e37e.tar.bz2
aports-41f154cbb278d2153108e922403a2492fa64e37e.tar.xz
main/unzip: add mitigation for CVE-2018-18384 (incomplete fix of CVE-2014-9913)
-rw-r--r--main/unzip/APKBUILD12
-rw-r--r--main/unzip/CVE-2018-18384.patch13
2 files changed, 22 insertions, 3 deletions
diff --git a/main/unzip/APKBUILD b/main/unzip/APKBUILD
index 2fad42a7b4..4728573ff2 100644
--- a/main/unzip/APKBUILD
+++ b/main/unzip/APKBUILD
@@ -3,7 +3,7 @@
pkgname=unzip
pkgver=6.0
_pkgver=${pkgver//./}
-pkgrel=8
+pkgrel=9
pkgdesc="Extract PKZIP-compatible .zip files"
url="http://www.info-zip.org/UnZip.html"
arch="all"
@@ -23,10 +23,13 @@ source="https://dev.alpinelinux.org/archive/unzip/unzip$_pkgver.tgz
CVE-2018-1000035.patch
fix-CVE-2014-8139.patch
CVE-2019-13232.patch
+ CVE-2018-18384.patch
"
builddir="$srcdir/$pkgname$_pkgver"
# secfixes:
+# 6.0-r9:
+# - CVE-2018-18384
# 6.0-r7:
# - CVE-2019-13232
# 6.0-r3:
@@ -56,7 +59,8 @@ package() {
"$pkgdir"/usr/share/licenses/$pkgname/LICENSE
}
-sha512sums="0694e403ebc57b37218e00ec1a406cae5cc9c5b52b6798e0d4590840b6cdbf9ddc0d9471f67af783e960f8fa2e620394d51384257dca23d06bcd90224a80ce5d unzip60.tgz
+sha512sums="
+0694e403ebc57b37218e00ec1a406cae5cc9c5b52b6798e0d4590840b6cdbf9ddc0d9471f67af783e960f8fa2e620394d51384257dca23d06bcd90224a80ce5d unzip60.tgz
9d2914f22fb0075a2b6f72825c235f46eafd8d47b6fb6fcc8303fc69336e256b15923c002d2615bb6af733344c2315e4a8504d77bae301e10c11d4736faa2c81 10-unzip-handle-pkware-verify.patch
57699582e9056af0817dcb67f8db67e6a1ff8208c137fbebcf559429e5f12b471b75d7e1ef938e5bbb5416074a51ac7342e4ce8057f4bbdcb0bf079b8d7832af 20-unzip-uidgid-fix.patch
b0b745cff474756447e699a13ff003871b33a4f7a24a91150e5a947eba5132fd90fbacf7580379fc13c5f638483b25cbc226f85b9cac9c7662b2f91927eb2bb3 unzip-6.0-heap-overflow-infloop.patch
@@ -67,4 +71,6 @@ b0b745cff474756447e699a13ff003871b33a4f7a24a91150e5a947eba5132fd90fbacf7580379fc
8c4a4313072ff0d87eadb0f5472eb48f2802b835dd282305811a96de87a41fed48be60fbdd434e6b6359418f0559f7793deaa1d68161a0c0ead9f8574bb9f14c CVE-2016-9844.patch
6f757385a23fe6a034f676df6bf233243afa8743761e3d715e532d066fcd7dc8f8dcd6192be693258f3855837e5534490784378768abe7ce710fb869258d49b7 CVE-2018-1000035.patch
13f9c54fcdde478c4afe391c8e7ef9c31b03228aaace5da38382612951cbfd60710fd3d931569297953be32b2c5906715aed4b1c05e28cc8fccbb27f38b57550 fix-CVE-2014-8139.patch
-d11758bda3b022f1adb4031bfbc770c6391e3470f3126ec5a4d3d2800d5452245eee26256f539d60adee33f01ba8ba8345299736cd9568da1242f6f739e4a598 CVE-2019-13232.patch"
+d11758bda3b022f1adb4031bfbc770c6391e3470f3126ec5a4d3d2800d5452245eee26256f539d60adee33f01ba8ba8345299736cd9568da1242f6f739e4a598 CVE-2019-13232.patch
+1edd66fbca3cfbfad7b19db0b1564b93f13b27b10ff157cf9907228184b56f1f4c87c2dd2a09afc1307ee86622f3aaeea46f8336c249249c8452304cf4d25272 CVE-2018-18384.patch
+"
diff --git a/main/unzip/CVE-2018-18384.patch b/main/unzip/CVE-2018-18384.patch
new file mode 100644
index 0000000000..ad28f8c499
--- /dev/null
+++ b/main/unzip/CVE-2018-18384.patch
@@ -0,0 +1,13 @@
+diff --git a/list.c b/list.c
+index f7359c3..4c3d703 100644
+--- a/list.c
++++ b/list.c
+@@ -97,7 +97,7 @@ int list_files(__G) /* return PK-type error code */
+ {
+ int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
+ #ifndef WINDLL
+- char sgn, cfactorstr[10];
++ char sgn, cfactorstr[13];
+ int longhdr=(uO.vflag>1);
+ #endif
+ int date_format;