CVE-2016-8568
CVE-2016-8569
---
main/libgit2/APKBUILD | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/main/libgit2/APKBUILD b/main/libgit2/APKBUILD
index e768971..9af3a89 100644
--- a/main/libgit2/APKBUILD
+++ b/main/libgit2/APKBUILD
@@ -2,8 +2,8 @@
# Contributor: Pierre-Gilas MILLON <pgmillon@gmail.com>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libgit2
-pkgver=0.24.2
-pkgrel=1
+pkgver=0.24.3
+pkgrel=0
pkgdesc="A linkable library for Git"
url="https://libgit2.github.com/"
arch="all"
@@ -11,11 +11,15 @@ license="GPLv2"
depends=""
depends_dev="curl-dev libssh2-dev"
makedepends="$depends_dev python2 cmake zlib-dev libressl-dev"
-install=""
subpackages="$pkgname-dev $pkgname-libs"
-source="$pkgname-$pkgver.tar.gz::https://github.com/${pkgname}/${pkgname}/archive/v${pkgver}.tar.gz"
+source="$pkgname-$pkgver.tar.gz::https://github.com/$pkgname/$pkgname/archive/v$pkgver.tar.gz"
builddir="$srcdir/$pkgname-$pkgver"
+# secfixes:
+# 0.24.3-r0:
+# - CVE-2016-8568
+# - CVE-2016-8569
+
build() {
cd "$builddir"
cmake \
@@ -34,6 +38,6 @@ package() {
-C "$builddir" install || return 1
}
-md5sums="735661b5b73e3c120d13e2bae21e49b3 libgit2-0.24.2.tar.gz"
-sha256sums="00f0a7403143fba69601accc80cacf49becc568b890ba232f300c1b2a37475e6 libgit2-0.24.2.tar.gz"
-sha512sums="aaba85ef65e00b5916642121dbf0e785c20332f29312e772186eef0eebba5c997a60f94dfb651cbab25c3070c7b4cc37e8619d9cb9fed590e1fb0460bcb7af02 libgit2-0.24.2.tar.gz"
+md5sums="df626711b16bd5e7021123cbf1655399 libgit2-0.24.3.tar.gz"
+sha256sums="0a24e6a51dbf3beecb0ebcd2cafb1e09b1212e910be6477b5de03c84a5586754 libgit2-0.24.3.tar.gz"
+sha512sums="cb7b482664a5527e2d7c8f7c98755fd578f5331bc39fa2a5c8b841508e075b06b936f2c4a55cb4d10fe5d1677b596387bb16d68c220f1f23fce0a894b092f8c4 libgit2-0.24.3.tar.gz"
--
2.10.2
---
Unsubscribe: alpine-aports+unsubscribe@lists.alpinelinux.org
Help: alpine-aports+help@lists.alpinelinux.org
---
---
main/p7zip/APKBUILD | 29 +++++++++++++++++++----------
main/p7zip/CVE-2016-9296.patch | 12 ++++++++++++
2 files changed, 31 insertions(+), 10 deletions(-)
create mode 100644 main/p7zip/CVE-2016-9296.patch
diff --git a/main/p7zip/APKBUILD b/main/p7zip/APKBUILD
index 24f1bce..0d5ea43 100644
--- a/main/p7zip/APKBUILD
+++ b/main/p7zip/APKBUILD
@@ -3,7 +3,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=p7zip
pkgver=16.02
-pkgrel=0
+pkgrel=1
pkgdesc="A command-line port of the 7zip compression utility"
url="http://p7zip.sourceforge.net"
arch="all"
@@ -11,18 +11,24 @@ license="LGPL2+"
subpackages="$pkgname-doc"
depends=""
makedepends="bash yasm nasm"
-install=""
-source="http://downloads.sourceforge.net/sourceforge/$pkgname/${pkgname}_${pkgver}_src_all.tar.bz2"
+source="http://downloads.sourceforge.net/sourceforge/$pkgname/${pkgname}_${pkgver}_src_all.tar.bz2
+ CVE-2016-9296.patch"
+builddir="$srcdir/${pkgname}_$pkgver"
+
+# secfixes:
+# 16.02-r1:
+# - CVE-2016-9296
-_builddir="$srcdir"/${pkgname}_${pkgver}
prepare() {
+ default_prepare || return 1
+
local makefile="makefile.linux_any_cpu_gcc_4.X"
case "$CARCH" in
x86) makefile="makefile.linux_x86_asm_gcc_4.X" ;;
x86_64) makefile="makefile.linux_amd64_asm" ;;
esac
- cd "$_builddir"
+ cd "$builddir"
ln -sf $makefile makefile.machine || return 1
sed -e "s,g++,${CXX:-g++}," -i makefile.machine
@@ -30,12 +36,12 @@ prepare() {
}
build() {
- cd "$_builddir"
+ cd "$builddir"
make all3 OPTFLAGS="${CXXFLAGS}" || return 1
}
package() {
- cd "$_builddir"
+ cd "$builddir"
make install DEST_DIR="$pkgdir" DEST_HOME="/usr" \
DEST_MAN="/usr/share/man" \
DEST_SHARE_DOC="/usr/share/doc/$pkgname" || return 1
@@ -46,6 +52,9 @@ package() {
"$pkgdir"/usr/share/man/man1/$pkgname.1 || return 1
}
-md5sums="a0128d661cfe7cc8c121e73519c54fbf p7zip_16.02_src_all.tar.bz2"
-sha256sums="5eb20ac0e2944f6cb9c2d51dd6c4518941c185347d4089ea89087ffdd6e2341f p7zip_16.02_src_all.tar.bz2"
-sha512sums="d2c4d53817f96bb4c7683f42045198d4cd509cfc9c3e2cb85c8d9dc4ab6dfa7496449edeac4e300ecf986a9cbbc90bd8f8feef8156895d94617c04e507add55f p7zip_16.02_src_all.tar.bz2"
+md5sums="a0128d661cfe7cc8c121e73519c54fbf p7zip_16.02_src_all.tar.bz2
+0f0535ca888273f3779ca14e8f186813 CVE-2016-9296.patch"
+sha256sums="5eb20ac0e2944f6cb9c2d51dd6c4518941c185347d4089ea89087ffdd6e2341f p7zip_16.02_src_all.tar.bz2
+f9bcbf21d4aa8938861a6cba992df13dec19538286e9ed747ccec6d9a4e8f983 CVE-2016-9296.patch"
+sha512sums="d2c4d53817f96bb4c7683f42045198d4cd509cfc9c3e2cb85c8d9dc4ab6dfa7496449edeac4e300ecf986a9cbbc90bd8f8feef8156895d94617c04e507add55f p7zip_16.02_src_all.tar.bz2
+7a7fddf4122c3f5d4632640149a94c285a18515f38510388709c2fb9ecd450f9f34ae2e5fe4926c1c68507567b0affa2c8e9194c732673171dd5ee625192b194 CVE-2016-9296.patch"
diff --git a/main/p7zip/CVE-2016-9296.patch b/main/p7zip/CVE-2016-9296.patch
new file mode 100644
index 0000000..773f92a
--- /dev/null
+++ b/main/p7zip/CVE-2016-9296.patch
@@ -0,0 +1,12 @@
+--- ./CPP/7zip/Archive/7z/7zIn.cpp.orig 2016-11-21 01:42:29.460901230 +0000
++++ ./CPP/7zip/Archive/7z/7zIn.cpp 2016-11-21 01:42:57.481197725 +0000
+@@ -1097,7 +1097,8 @@ HRESULT CInArchive::ReadAndDecodePackedS
+ if (CrcCalc(data, unpackSize) != folders.FolderCRCs.Vals[i])
+ ThrowIncorrect();
+ }
+- HeadersSize += folders.PackPositions[folders.NumPackStreams];
++ if (folders.PackPositions)
++ HeadersSize += folders.PackPositions[folders.NumPackStreams];
+ return S_OK;
+ }
+
--
2.10.2
---
Unsubscribe: alpine-aports+unsubscribe@lists.alpinelinux.org
Help: alpine-aports+help@lists.alpinelinux.org
---