diff options
author | root <root@rshg054.dnsready.net> | 2013-10-10 01:59:31 -0700 |
---|---|---|
committer | root <root@rshg054.dnsready.net> | 2013-10-10 01:59:31 -0700 |
commit | 361f95d1ff881daf5f87cb14917bd524511abfc5 (patch) | |
tree | 80a94568027dded4548d525a8a3ed7621ccf325d /extra | |
parent | 737832e1bd70820f477143512b5c89a30a6e81d0 (diff) |
Thu Oct 10 01:58:46 PDT 2013
Diffstat (limited to 'extra')
-rw-r--r-- | extra/ffmpeg/PKGBUILD | 11 | ||||
-rw-r--r-- | extra/gnome-dictionary/PKGBUILD | 6 | ||||
-rw-r--r-- | extra/samba/PKGBUILD | 6 | ||||
-rw-r--r-- | extra/uim/PKGBUILD | 9 | ||||
-rw-r--r-- | extra/xorg-server/0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch | 76 | ||||
-rw-r--r-- | extra/xorg-server/PKGBUILD | 23 |
6 files changed, 112 insertions, 19 deletions
diff --git a/extra/ffmpeg/PKGBUILD b/extra/ffmpeg/PKGBUILD index b4ed466d5..f62f62fdb 100644 --- a/extra/ffmpeg/PKGBUILD +++ b/extra/ffmpeg/PKGBUILD @@ -1,25 +1,25 @@ -# $Id: PKGBUILD 192419 2013-08-11 13:05:15Z bpiotrowski $ +# $Id: PKGBUILD 196252 2013-10-09 20:32:23Z bpiotrowski $ # Maintainer : Ionut Biru <ibiru@archlinux.org> # Contributor: Tom Newsom <Jeepster@gmx.co.uk> # Contributor: Paul Mattal <paul@archlinux.org> pkgname=ffmpeg -pkgver=2.0.1 -pkgrel=1 +pkgver=2.0.2 +pkgrel=2 epoch=1 pkgdesc="Complete and free Internet live audio and video broadcasting solution for Linux/Unix" arch=('i686' 'x86_64') url="http://ffmpeg.org/" license=('GPL') depends=( - 'alsa-lib' 'bzip2' 'fontconfig' 'gsm' 'lame' 'libass' + 'alsa-lib' 'bzip2' 'fontconfig' 'gnutls' 'gsm' 'lame' 'libass' 'libbluray' 'libmodplug' 'libpulse' 'libtheora' 'libva' 'libvorbis' 'libvpx' 'opencore-amr' 'openjpeg' 'opus' 'rtmpdump' 'schroedinger' 'sdl' 'speex' 'v4l-utils' 'x264' 'xvidcore' 'zlib' ) makedepends=('libvdpau' 'yasm') source=(http://ffmpeg.org/releases/$pkgname-$pkgver.tar.bz2) -sha256sums=('611eae7e3485d5fd9ff03e0ac7575ea89bc8105e40e99a40de02324957482f95') +sha256sums=('986f63dc0785f473b1832d0eead502e39c9706fbe7f9677bbea0dad6fe0fab4a') build() { cd $pkgname-$pkgver @@ -31,6 +31,7 @@ build() { --enable-avresample \ --enable-dxva2 \ --enable-fontconfig \ + --enable-gnutls \ --enable-gpl \ --enable-libass \ --enable-libbluray \ diff --git a/extra/gnome-dictionary/PKGBUILD b/extra/gnome-dictionary/PKGBUILD index dba419724..797c9cb9f 100644 --- a/extra/gnome-dictionary/PKGBUILD +++ b/extra/gnome-dictionary/PKGBUILD @@ -1,8 +1,8 @@ -# $Id: PKGBUILD 196059 2013-10-07 11:51:24Z jgc $ +# $Id: PKGBUILD 196236 2013-10-09 09:41:32Z heftig $ # Maintainer: Ionut Biru <ibiru@archlinux.org> pkgname=gnome-dictionary -pkgver=3.9.0 +pkgver=3.10.0 pkgrel=1 pkgdesc="Look up words in dictionary sources" arch=(i686 x86_64) @@ -14,7 +14,7 @@ install=$pkgname.install options=(!libtool) groups=('gnome') source=(http://download.gnome.org/sources/$pkgname/${pkgver%.*}/$pkgname-$pkgver.tar.xz) -sha256sums=('4881096d5952ca39e19e4ecfb37f16634d5f5c1e41ee1e74fa8550f59f5bd455') +sha256sums=('258b60fe50f7d0580a7dc3bb83f7fe2f6f0597d4013d97ac083c3f062c350ed7') build() { cd $pkgname-$pkgver diff --git a/extra/samba/PKGBUILD b/extra/samba/PKGBUILD index aecf438a9..f779c4aa2 100644 --- a/extra/samba/PKGBUILD +++ b/extra/samba/PKGBUILD @@ -10,11 +10,11 @@ pkgbase=samba pkgname=('libwbclient' 'smbclient' 'samba') -pkgver=4.0.9 +pkgver=4.0.10 # We use the 'A' to fake out pacman's version comparators. Samba chooses # to append 'a','b',etc to their subsequent releases, which pamcan # misconstrues as alpha, beta, etc. Bad samba! -_realver=4.0.9 +_realver=4.0.10 pkgrel=1 arch=(i686 x86_64) url="http://www.samba.org" @@ -245,7 +245,7 @@ sys.path.insert(0, '/usr/lib/python${_pyver}/site-packages')" \ # copy ldap example install -D -m644 ${srcdir}/samba-${_realver}/examples/LDAP/samba.schema ${pkgdir}/usr/share/doc/samba/examples/LDAP/samba.schema } -md5sums=('f5f2ad0e2aabf024e2e3e2f297a0631a' +md5sums=('220740f75035b2221e3b9a848e19d1ea' '5697da77590ec092cc8a883bae06093c' 'ee8507839745cf17d2fb5401be7da6a8' '96f82c38f3f540b53f3e5144900acf17' diff --git a/extra/uim/PKGBUILD b/extra/uim/PKGBUILD index 1d51ed253..c2801c831 100644 --- a/extra/uim/PKGBUILD +++ b/extra/uim/PKGBUILD @@ -1,20 +1,19 @@ -# $Id: PKGBUILD 189234 2013-07-01 01:03:08Z bisson $ +# $Id: PKGBUILD 196248 2013-10-09 16:10:58Z bisson $ # Maintainer: Gaetan Bisson <bisson@archlinux.org> # Contributor: damir <damir@archlinux.org> pkgname=uim pkgver=1.8.6 -pkgrel=1 +pkgrel=2 pkgdesc='Multilingual input method library' url='http://code.google.com/p/uim/' license=('custom:BSD') arch=('i686' 'x86_64') depends=('libxft' 'libedit' 'anthy' 'm17n-lib') -makedepends=('intltool' 'gettext' 'qt4' 'gtk2' 'gtk3' 'gnome-panel') +makedepends=('intltool' 'gettext' 'qt4' 'gtk2' 'gtk3') optdepends=('qt4: immodule and helper applications' 'gtk2: immodule and helper applications' - 'gtk3: immodules and helper applications' - 'gnome-panel: gnome applet indicator') + 'gtk3: immodules and helper applications') options=('!libtool') source=("https://uim.googlecode.com/files/${pkgname}-${pkgver}.tar.gz") sha1sums=('409c30b31b9e58e3c18cb7862933487b0585cd1d') diff --git a/extra/xorg-server/0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch b/extra/xorg-server/0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch new file mode 100644 index 000000000..b550bcedd --- /dev/null +++ b/extra/xorg-server/0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch @@ -0,0 +1,76 @@ +From 7bddc2ba16a2a15773c2ea8947059afa27727764 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Mon, 16 Sep 2013 21:47:16 -0700 +Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText() + [CVE-2013-4396] + +Save a pointer to the passed in closure structure before copying it +and overwriting the *c pointer to point to our copy instead of the +original. If we hit an error, once we free(c), reset c to point to +the original structure before jumping to the cleanup code that +references *c. + +Since one of the errors being checked for is whether the server was +able to malloc(c->nChars * itemSize), the client can potentially pass +a number of characters chosen to cause the malloc to fail and the +error path to be taken, resulting in the read from freed memory. + +Since the memory is accessed almost immediately afterwards, and the +X server is mostly single threaded, the odds of the free memory having +invalid contents are low with most malloc implementations when not using +memory debugging features, but some allocators will definitely overwrite +the memory there, leading to a likely crash. + +Reported-by: Pedro Ribeiro <pedrib@gmail.com> +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> +Reviewed-by: Julien Cristau <jcristau@debian.org> +--- + dix/dixfonts.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/dix/dixfonts.c b/dix/dixfonts.c +index feb765d..2e34d37 100644 +--- a/dix/dixfonts.c ++++ b/dix/dixfonts.c +@@ -1425,6 +1425,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + GC *pGC; + unsigned char *data; + ITclosurePtr new_closure; ++ ITclosurePtr old_closure; + + /* We're putting the client to sleep. We need to + save some state. Similar problem to that handled +@@ -1436,12 +1437,14 @@ doImageText(ClientPtr client, ITclosurePtr c) + err = BadAlloc; + goto bail; + } ++ old_closure = c; + *new_closure = *c; + c = new_closure; + + data = malloc(c->nChars * itemSize); + if (!data) { + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1452,6 +1455,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + if (!pGC) { + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1464,6 +1468,7 @@ doImageText(ClientPtr client, ITclosurePtr c) + FreeScratchGC(pGC); + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +-- +1.7.9.2 + diff --git a/extra/xorg-server/PKGBUILD b/extra/xorg-server/PKGBUILD index e6e01ef2a..064578096 100644 --- a/extra/xorg-server/PKGBUILD +++ b/extra/xorg-server/PKGBUILD @@ -1,11 +1,11 @@ -# $Id: PKGBUILD 194374 2013-09-15 07:40:13Z andyrtr $ +# $Id: PKGBUILD 196227 2013-10-08 22:59:23Z lcarlier $ # Maintainer: AndyRTR <andyrtr@archlinux.org> # Maintainer: Jan de Groot <jgc@archlinux.org> pkgbase=xorg-server pkgname=('xorg-server' 'xorg-server-xephyr' 'xorg-server-xdmx' 'xorg-server-xvfb' 'xorg-server-xnest' 'xorg-server-common' 'xorg-server-devel') pkgver=1.14.3 -pkgrel=1 +pkgrel=2 arch=('i686' 'x86_64') license=('custom') url="http://xorg.freedesktop.org" @@ -23,7 +23,8 @@ source=(${url}/releases/individual/xserver/${pkgbase}-${pkgver}.tar.bz2 xvfb-run xvfb-run.1 10-quirks.conf - fb-rename-wfbDestroyGlyphCache.patch) + fb-rename-wfbDestroyGlyphCache.patch + 0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch) sha256sums=('02125ae13a443dcbb55f964d5c37f1da2f58ad54c2102356037bec23c1b84f5e' '66e25f76a7496c429e0aff4b0670f168719bb0ceaeb88c6f2272f2bf3ed21162' 'd027776fac1f7675b0a9ee817502290b1c45f9c09b0f0a6bb058c35f92361e84' @@ -54,7 +55,12 @@ prepare() { # http://cgit.freedesktop.org/xorg/xserver/commit/fb/wfbrename.h?id=5047810a4c20fab444b8c6eb146c55dcdb0d4219 patch -Np1 -i ../fb-rename-wfbDestroyGlyphCache.patch + + # CVE-2013-4396: Use after free in Xserver handling of ImageText requests + # (to be included in xorg-server 1.15.0 and 1.14.4) + patch -Np1 -i ../0001-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch } + build() { cd "${pkgbase}-${pkgver}" autoreconf -fi @@ -218,3 +224,14 @@ package_xorg-server-devel() { install -m755 -d "${pkgdir}/usr/share/licenses/xorg-server-devel" ln -sf ../xorg-server-common/COPYING "${pkgdir}/usr/share/licenses/xorg-server-devel/COPYING" } +sha256sums=('02125ae13a443dcbb55f964d5c37f1da2f58ad54c2102356037bec23c1b84f5e' + '66e25f76a7496c429e0aff4b0670f168719bb0ceaeb88c6f2272f2bf3ed21162' + 'd027776fac1f7675b0a9ee817502290b1c45f9c09b0f0a6bb058c35f92361e84' + 'e033f9bcc21980f7f0428e6ed6c362a3d55ad293b05fd6e6c6c1933b86f9e63a' + '26ee6ff255a60d7c1e136c612925eb63c86e85a4a3a55d531852ad9275526588' + 'bb63658d250c21bbfaf94c5417f2920ce5963ee1f7db6cac2b163a54f2e9b619' + 'ff0156309470fc1d378fd2e104338020a884295e285972cc88e250e031cc35b9' + '2460adccd3362fefd4cdc5f1c70f332d7b578091fb9167bf88b5f91265bbd776' + '94612f5c0d34a3b7152915c2e285c7b462e9d8e38d3539bd551a339498eac166' + 'd0832cc16b5e6c1dee2959055a4b327f5c87e2a67b5f427d654663057207b2c1' + '2b90ce92a900b6d4edda9ef33acdd3d2c2708fec2344175c2d8dfd4265f56d32') |