Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=789a67842009833dcec5183bb9937f57b0af2229
commit 789a67842009833dcec5183bb9937f57b0af2229 Author: kikadf <[email protected]> Date: Mon Jun 2 17:03:15 2014 +0200 php-5.3.26-2arcturus2-x86_64 * Fix CVE-2014-0185, CVE-2014-0237, CVE-2014-0238, CVE-2014-2270 diff --git a/source/devel/php/CVE-2014-0185.patch b/source/devel/php/CVE-2014-0185.patch new file mode 100644 index 0000000..389f62e --- /dev/null +++ b/source/devel/php/CVE-2014-0185.patch @@ -0,0 +1,26 @@ +--- php5.orig/sapi/fpm/fpm/fpm_unix.c ++++ php5/sapi/fpm/fpm/fpm_unix.c +@@ -34,7 +34,7 @@ int fpm_unix_resolve_socket_premissions( + /* uninitialized */ + wp->socket_uid = -1; + wp->socket_gid = -1; +- wp->socket_mode = 0666; ++ wp->socket_mode = 0660; + + if (!c) { + return 0; +--- php5.orig/sapi/fpm/php-fpm.conf.in ++++ php5/sapi/fpm/php-fpm.conf.in +@@ -162,10 +162,10 @@ listen = /var/run/php5-fpm.sock + ; permissions must be set in order to allow connections from a web server. Many + ; BSD-derived systems allow connections regardless of permissions. + ; Default Values: user and group are set as the running user +-; mode is set to 0666 ++; mode is set to 0660 + ;listen.owner = @php_fpm_user@ + ;listen.group = @php_fpm_group@ +-;listen.mode = 0666 ++;listen.mode = 0660 + + ; List of ipv4 addresses of FastCGI clients which are allowed to connect. + ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original diff --git a/source/devel/php/CVE-2014-0237.patch b/source/devel/php/CVE-2014-0237.patch new file mode 100644 index 0000000..ea96af0 --- /dev/null +++ b/source/devel/php/CVE-2014-0237.patch @@ -0,0 +1,36 @@ +--- php5.orig/ext/fileinfo/libmagic/cdf.c ++++ php5/ext/fileinfo/libmagic/cdf.c +@@ -942,7 +942,7 @@ int + cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h, + cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count) + { +- size_t i, maxcount; ++ size_t maxcount; + const cdf_summary_info_header_t *si = + CAST(const cdf_summary_info_header_t *, sst->sst_tab); + const cdf_section_declaration_t *sd = +@@ -957,21 +957,13 @@ cdf_unpack_summary_info(const cdf_stream + ssi->si_os = CDF_TOLE2(si->si_os); + ssi->si_class = si->si_class; + cdf_swap_class(&ssi->si_class); +- ssi->si_count = CDF_TOLE2(si->si_count); ++ ssi->si_count = CDF_TOLE4(si->si_count); + *count = 0; + maxcount = 0; + *info = NULL; +- for (i = 0; i < CDF_TOLE4(si->si_count); i++) { +- if (i >= CDF_LOOP_LIMIT) { +- DPRINTF(("Unpack summary info loop limit")); +- errno = EFTYPE; ++ if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info, ++ count, &maxcount) == -1) + return -1; +- } +- if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), +- info, count, &maxcount) == -1) { +- return -1; +- } +- } + return 0; + } + diff --git a/source/devel/php/CVE-2014-0238.patch b/source/devel/php/CVE-2014-0238.patch new file mode 100644 index 0000000..4bb631c --- /dev/null +++ b/source/devel/php/CVE-2014-0238.patch @@ -0,0 +1,24 @@ +--- php5.orig/ext/fileinfo/libmagic/cdf.c ++++ php5/ext/fileinfo/libmagic/cdf.c +@@ -823,6 +823,10 @@ cdf_read_property_info(const cdf_stream_ + i, inp[i].pi_id, inp[i].pi_type, q - p, offs)); + if (inp[i].pi_type & CDF_VECTOR) { + nelements = CDF_GETUINT32(q, 1); ++ if (nelements == 0) { ++ DPRINTF(("CDF_VECTOR with nelements == 0\n")); ++ goto out; ++ } + o = 2; + } else { + nelements = 1; +@@ -897,7 +901,9 @@ cdf_read_property_info(const cdf_stream_ + } + DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n", + nelements)); +- for (j = 0; j < nelements; j++, i++) { ++ for (j = 0; j < nelements && i < sh.sh_properties; ++ j++, i++) ++ { + uint32_t l = CDF_GETUINT32(q, o); + inp[i].pi_str.s_len = l; + inp[i].pi_str.s_buf = (const char *) diff --git a/source/devel/php/CVE-2014-2270.patch b/source/devel/php/CVE-2014-2270.patch new file mode 100644 index 0000000..9f92bd2 --- /dev/null +++ b/source/devel/php/CVE-2014-2270.patch @@ -0,0 +1,83 @@ +--- php5.orig/ext/fileinfo/libmagic/softmagic.c ++++ php5/ext/fileinfo/libmagic/softmagic.c +@@ -65,6 +65,8 @@ private void cvt_16(union VALUETYPE *, c + private void cvt_32(union VALUETYPE *, const struct magic *); + private void cvt_64(union VALUETYPE *, const struct magic *); + ++#define OFFSET_OOB(n, o, i) ((n) < (o) || (i) > ((n) - (o))) ++ + /* + * softmagic - lookup one file in parsed, in-memory copy of database + * Passed the name and FILE * of one file to be typed. +@@ -1056,7 +1058,7 @@ mget(struct magic_set *ms, const unsigne + } + switch (m->in_type) { + case FILE_BYTE: +- if (nbytes < (offset + 1)) ++ if (OFFSET_OOB(nbytes, offset, 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1091,7 +1093,7 @@ mget(struct magic_set *ms, const unsigne + offset = ~offset; + break; + case FILE_BESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1143,7 +1145,7 @@ mget(struct magic_set *ms, const unsigne + offset = ~offset; + break; + case FILE_LESHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1195,7 +1197,7 @@ mget(struct magic_set *ms, const unsigne + offset = ~offset; + break; + case FILE_SHORT: +- if (nbytes < (offset + 2)) ++ if (OFFSET_OOB(nbytes, offset, 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1232,7 +1234,7 @@ mget(struct magic_set *ms, const unsigne + break; + case FILE_BELONG: + case FILE_BEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1303,7 +1305,7 @@ mget(struct magic_set *ms, const unsigne + break; + case FILE_LELONG: + case FILE_LEID3: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1373,7 +1375,7 @@ mget(struct magic_set *ms, const unsigne + offset = ~offset; + break; + case FILE_MELONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { +@@ -1443,7 +1445,7 @@ mget(struct magic_set *ms, const unsigne + offset = ~offset; + break; + case FILE_LONG: +- if (nbytes < (offset + 4)) ++ if (OFFSET_OOB(nbytes, offset, 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index 8b8bcd3..d032fbf 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=2arcturus1 +pkgrel=2arcturus2 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -35,13 +35,18 @@ subarchs=('i686 x86_64') # FSA fix *** -source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch \ - CVE-2013-6712.patch CVE-2014-1943.patch) +source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch + CVE-2013-6712.patch CVE-2014-1943.patch CVE-2014-0185.patch + CVE-2014-0237.patch CVE-2014-0238.patch CVE-2014-2270.patch) sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ '0e2ad0691c8a4bbb128d978f21f79e36df1a0bf5' \ - 'ff4c9a129952081b9db72f5b941f6ffc53a6213d') + 'ff4c9a129952081b9db72f5b941f6ffc53a6213d' \ + '89eb79fa23e49a3cf0ee4929233fccbbd2b9367d' \ + '9fd5280138a6a9d8bfa4c5239f9451869985de35' \ + '2c0db438c6773d5bc9d1af3b637c4d8cd93bf4e7' \ + 'e2c4c40700c1004c4924abc329fc4f75030350e0') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
