Lukas Fleischer pushed to branch main at Arch Linux / Packaging / Packages / zip
Commits: 0d11bd62 by Lukas Fleischer at 2026-08-14T16:15:38-04:00 upgpkg: 3.0-14 Add patches to fix CVE-2018-13410 and https://seclists.org/oss-sec/2026/q3/494. - - - - - 2 changed files: - .SRCINFO - PKGBUILD Changes: ===================================== .SRCINFO ===================================== @@ -1,7 +1,7 @@ pkgbase = zip pkgdesc = Compressor/archiver for creating and modifying zipfiles pkgver = 3.0 - pkgrel = 13 + pkgrel = 14 url = http://www.info-zip.org/Zip.html arch = x86_64 license = LicenseRef-Info-ZIP @@ -13,11 +13,15 @@ pkgbase = zip source = https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/zip-3.0-format-security.patch source = https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/zipnote.patch source = https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/buffer_overflow.patch + source = https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/buffer-overflow-cve-2018-13410.patch + source = https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch sha256sums = f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369 sha256sums = 44cac3d4e8b447988b6e4eeb4bb6e701110cedfb09ea49eac471011328c8acab sha256sums = 10f0f3756a2415e33edf1455373b322404962b743b3a52a757b669e47dd7f1b2 sha256sums = 3759134487afad9c63e2e9693aa05b9dcc67f55a9ef961e82074b587b094292a sha256sums = 89249a3f1fdf838b795ce432a2d763fdbe913d6a146541e41b7a2e2769291ba0 sha256sums = d74384c0159662b83c9b8080e92c77c0816a763e926014c612e672835a1ad1f7 + sha256sums = 39461c3ffd5fbd2a377779855c9e3e87e30e0db235e41256c6547a752da1f388 + sha256sums = 0905dd62604a4db8d7d9fb2bc228f355e90635fbc32208c21ed72bde1541bdc4 pkgname = zip ===================================== PKGBUILD ===================================== @@ -4,7 +4,7 @@ pkgname=zip pkgver=3.0 _pkgver=${pkgver/./} -pkgrel=13 +pkgrel=14 pkgdesc='Compressor/archiver for creating and modifying zipfiles' url='http://www.info-zip.org/Zip.html' arch=('x86_64') @@ -15,13 +15,17 @@ source=("https://downloads.sourceforge.net/infozip/${pkgname}${_pkgver}.tar.gz"; 'https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/zip-3.0-exec-shield.patch' 'https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/zip-3.0-format-security.patch' 'https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/zipnote.patch' - 'https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/buffer_overflow.patch') + 'https://src.fedoraproject.org/rpms/zip/raw/rawhide/f/buffer_overflow.patch' + 'https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/buffer-overflow-cve-2018-13410.patch' + 'https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch') sha256sums=('f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369' '44cac3d4e8b447988b6e4eeb4bb6e701110cedfb09ea49eac471011328c8acab' '10f0f3756a2415e33edf1455373b322404962b743b3a52a757b669e47dd7f1b2' '3759134487afad9c63e2e9693aa05b9dcc67f55a9ef961e82074b587b094292a' '89249a3f1fdf838b795ce432a2d763fdbe913d6a146541e41b7a2e2769291ba0' - 'd74384c0159662b83c9b8080e92c77c0816a763e926014c612e672835a1ad1f7') + 'd74384c0159662b83c9b8080e92c77c0816a763e926014c612e672835a1ad1f7' + '39461c3ffd5fbd2a377779855c9e3e87e30e0db235e41256c6547a752da1f388' + '0905dd62604a4db8d7d9fb2bc228f355e90635fbc32208c21ed72bde1541bdc4') options=('!makeflags') @@ -35,6 +39,8 @@ prepare() { patch -p1 -i ../zip-3.0-format-security.patch patch -p1 -i ../zipnote.patch patch -p1 -i ../buffer_overflow.patch + patch -p1 -i ../buffer-overflow-cve-2018-13410.patch + patch -p1 -i ../fix-command-injection.patch } build() { View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/zip/-/commit/0d11bd624c12908ddcb544ab427184e0952fe517 -- View it on GitLab: https://gitlab.archlinux.org/archlinux/packaging/packages/zip/-/commit/0d11bd624c12908ddcb544ab427184e0952fe517 You're receiving this email because of your account on gitlab.archlinux.org. Manage all notifications: https://gitlab.archlinux.org/-/profile/notifications | Help: https://gitlab.archlinux.org/help
