Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=68054b6690e2f80c638e803cf7eecd04589cc7b4
commit 68054b6690e2f80c638e803cf7eecd04589cc7b4 Author: kikadf <[email protected]> Date: Mon Jun 23 15:16:30 2014 +0200 php-5.3.26-2arcturus3-x86_64 * Fix CVE-2014-4049 diff --git a/source/devel/php/CVE-2014-4049.patch b/source/devel/php/CVE-2014-4049.patch new file mode 100644 index 0000000..380d7cf --- /dev/null +++ b/source/devel/php/CVE-2014-4049.patch @@ -0,0 +1,27 @@ +From 4f73394fdd95d3165b4391e1b0dedd57fced8c3b Mon Sep 17 00:00:00 2001 +From: Sara Golemon <[email protected]> +Date: Tue, 10 Jun 2014 11:18:02 -0700 +Subject: [PATCH] Fix potential segfault in dns_get_record() + +If the remote sends us a packet with a malformed TXT record, +we could end up trying to over-consume the packet and wander +off into overruns. +--- + ext/standard/dns.c | 4 ++++ + 1 file changed, 4 insertions(+) + +Index: php5-5.3.10/ext/standard/dns.c +=================================================================== +--- php5-5.3.10.orig/ext/standard/dns.c 2014-06-19 13:42:51.333434663 -0400 ++++ php5-5.3.10/ext/standard/dns.c 2014-06-19 13:42:51.289434662 -0400 +@@ -507,6 +507,10 @@ + + while (ll < dlen) { + n = cp[ll]; ++ if ((ll + n) >= dlen) { ++ // Invalid chunk length, truncate ++ n = dlen - (ll + 1); ++ } + memcpy(tp + ll , cp + ll + 1, n); + add_next_index_stringl(entries, cp + ll + 1, n, 1); + ll = ll + n + 1; diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index d032fbf..6b9ca01 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=2arcturus2 +pkgrel=2arcturus3 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -37,7 +37,8 @@ subarchs=('i686 x86_64') # FSA fix *** source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch CVE-2013-6712.patch CVE-2014-1943.patch CVE-2014-0185.patch - CVE-2014-0237.patch CVE-2014-0238.patch CVE-2014-2270.patch) + CVE-2014-0237.patch CVE-2014-0238.patch CVE-2014-2270.patch + CVE-2014-4049.patch) sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ @@ -46,7 +47,8 @@ sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ '89eb79fa23e49a3cf0ee4929233fccbbd2b9367d' \ '9fd5280138a6a9d8bfa4c5239f9451869985de35' \ '2c0db438c6773d5bc9d1af3b637c4d8cd93bf4e7' \ - 'e2c4c40700c1004c4924abc329fc4f75030350e0') + 'e2c4c40700c1004c4924abc329fc4f75030350e0' \ + 'a3fa0995e26e03681f0ce20289587645e6a4e401') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
