Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=04c1457f7e65982b9f4debde4ccb148571ef99b2
commit 04c1457f7e65982b9f4debde4ccb148571ef99b2 Author: kikadf <[email protected]> Date: Mon Jun 2 15:21:09 2014 +0200 gnutls-2.12.17-2arcturus2-x86_64 * Fix CVE-2014-3466 diff --git a/source/lib/gnutls/CVE-2014-3466.patch b/source/lib/gnutls/CVE-2014-3466.patch new file mode 100644 index 0000000..7ecef3a --- /dev/null +++ b/source/lib/gnutls/CVE-2014-3466.patch @@ -0,0 +1,26 @@ +From 89238044ade02c4d80e334ab74056ef28599663d Mon Sep 17 00:00:00 2001 +From: Nikos Mavrogiannopoulos <[email protected]> +Date: Fri, 23 May 2014 19:53:03 +0200 +Subject: [PATCH] Prevent memory corruption due to server hello parsing. + +Issue discovered by Joonas Kuorilehto of Codenomicon. +--- + lib/gnutls_handshake.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c +index e4a63e4..e652528 100644 +--- a/lib/gnutls_handshake.c ++++ b/lib/gnutls_handshake.c +@@ -1797,7 +1797,7 @@ _gnutls_read_server_hello (gnutls_session_t session, + DECR_LEN (len, 1); + session_id_len = data[pos++]; + +- if (len < session_id_len) ++ if (len < session_id_len || session_id_len > TLS_MAX_SESSION_ID_SIZE) + { + gnutls_assert (); + return GNUTLS_E_UNSUPPORTED_VERSION_PACKET; +-- +2.0.0.rc2 + diff --git a/source/lib/gnutls/FrugalBuild b/source/lib/gnutls/FrugalBuild index 2e058de..92d2b0a 100644 --- a/source/lib/gnutls/FrugalBuild +++ b/source/lib/gnutls/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=gnutls pkgver=2.12.17 -pkgrel=2arcturus1 +pkgrel=2arcturus2 pkgdesc="A library which provides a secure layer over a reliable transport layer" url="http://www.gnu.org/software/gnutls/"; groups=('lib') @@ -20,8 +20,8 @@ Finclude texinfo signatures=($source.sig) # FSA fix *** -source=(${source[@]} CVE-2014-1959.patch CVE-2014-0092.patch) -signatures=(${signatures[@]} '' '') +source=(${source[@]} CVE-2014-1959.patch CVE-2014-0092.patch CVE-2014-3466.patch) +signatures=(${signatures[@]} '' '' '') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
