Hello community, here is the log from the commit of package libusbmuxd for openSUSE:Factory checked in at 2016-06-02 12:37:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libusbmuxd (Old) and /work/SRC/openSUSE:Factory/.libusbmuxd.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libusbmuxd" Changes: -------- --- /work/SRC/openSUSE:Factory/libusbmuxd/libusbmuxd.changes 2016-02-25 21:43:55.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.libusbmuxd.new/libusbmuxd.changes 2016-06-02 12:37:44.000000000 +0200 @@ -1,0 +2,6 @@ +Fri May 27 13:11:35 UTC 2016 - [email protected] + +- Add libusbmuxd-CVE-2016-5104.patch: Make sure sockets only + listen locally (CVE-2016-5104, boo#982014). + +------------------------------------------------------------------- New: ---- libusbmuxd-CVE-2016-5104.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libusbmuxd.spec ++++++ --- /var/tmp/diff_new_pack.MaDlp8/_old 2016-06-02 12:37:45.000000000 +0200 +++ /var/tmp/diff_new_pack.MaDlp8/_new 2016-06-02 12:37:45.000000000 +0200 @@ -25,6 +25,8 @@ Url: http://cgit.sukimashita.com/libusbmuxd.git Source: http://www.libimobiledevice.org/downloads/%{name}-%{version}.tar.bz2 Source99: baselibs.conf +# PATCH-FIX-UPSTREAM libusbmuxd-CVE-2016-5104.patch CVE-2016-5104 boo#982014 [email protected] - Make sure sockets only listen locally +Patch0: libusbmuxd-CVE-2016-5104.patch BuildRequires: gcc-c++ BuildRequires: libplist-devel >= 1.11 BuildRequires: libusb-1_0-devel >= 1.0.3 @@ -92,6 +94,7 @@ %prep %setup -q +%patch0 -p1 %build %configure ++++++ libusbmuxd-CVE-2016-5104.patch ++++++ >From 4397b3376dc4e4cb1c991d0aed61ce6482614196 Mon Sep 17 00:00:00 2001 From: Joshua Hill <[email protected]> Date: Tue, 29 Dec 2015 23:09:37 +0100 Subject: [PATCH] common: [security fix] Make sure sockets only listen locally --- common/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/common/socket.c b/common/socket.c index 27b93ba..4cdefd6 100644 --- a/common/socket.c +++ b/common/socket.c @@ -203,7 +203,7 @@ int socket_create(uint16_t port) memset((void *) &saddr, 0, sizeof(saddr)); saddr.sin_family = AF_INET; - saddr.sin_addr.s_addr = htonl(INADDR_ANY); + saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); saddr.sin_port = htons(port); if (0 > bind(sfd, (struct sockaddr *) &saddr, sizeof(saddr))) { @@ -368,7 +368,7 @@ int socket_accept(int fd, uint16_t port) memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; - addr.sin_addr.s_addr = htonl(INADDR_ANY); + addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); addr.sin_port = htons(port); addr_len = sizeof(addr);
