Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=c882a8a42c9e1d305ecac28b59a6a8750bcb8852
commit c882a8a42c9e1d305ecac28b59a6a8750bcb8852 Author: kikadf <[email protected]> Date: Tue Oct 7 16:33:00 2014 +0200 mantis-1.2.8-2arcturus2-x86_64 * Fix CVE-2014-6387 diff --git a/source/network-extra/mantis/CVE-2014-6387.patch b/source/network-extra/mantis/CVE-2014-6387.patch new file mode 100644 index 0000000..d67c100 --- /dev/null +++ b/source/network-extra/mantis/CVE-2014-6387.patch @@ -0,0 +1,37 @@ +commit 215968fa8ff33e327f0600765a5caa24de392cbc +Author: Paul Richards <[email protected]> +Date: Sat Oct 12 22:58:43 2013 +0100 + + Strip null bytes out of GPC input strings + + Backporting commit fc02c46eea9d9e7cc472a7fc1801ea65d467db76 from master + branch to fix issue #17640 + + Signed-off-by: Damien Regad <[email protected]> + +diff --git a/core/gpc_api.php b/core/gpc_api.php +index 2daad98..58e0827 100644 +--- a/core/gpc_api.php ++++ b/core/gpc_api.php +@@ -110,7 +110,7 @@ function gpc_get_string( $p_var_name, $p_default = null ) { + trigger_error( ERROR_GPC_ARRAY_UNEXPECTED, ERROR ); + } + +- return $t_result; ++ return str_replace( "\0","",$t_result ); + } + + /** +@@ -255,7 +255,11 @@ function gpc_get_string_array( $p_var_name, $p_default = null ) { + trigger_error( ERROR_GPC_ARRAY_EXPECTED, ERROR ); + } + +- return $t_result; ++ $t_array = array(); ++ foreach( $t_result as $key => $val ) { ++ $t_array[$key] = str_replace( "\0", "", $val ); ++ } ++ return $t_array; + } + + /** diff --git a/source/network-extra/mantis/FrugalBuild b/source/network-extra/mantis/FrugalBuild index 13459cf..5867322 100644 --- a/source/network-extra/mantis/FrugalBuild +++ b/source/network-extra/mantis/FrugalBuild @@ -3,7 +3,7 @@ pkgname=mantis pkgver=1.2.8 -pkgrel=2arcturus1 +pkgrel=2arcturus2 pkgdesc="a free popular web-based bugtracking system" rodepends=('php>=4.0.6' 'mysql>=3.23.2') groups=('network-extra') @@ -22,12 +22,12 @@ sha1sums=('6cff6fd7d709e25c620c9717d6bf079ce52b73c5' \ 'd62d9493d254e33f8ec793a50ed3d3742e7b8110') # FSA fix *** -source=(${source[@]} CVE-2014-1608.patch CVE-2014-1609.patch) +source=(${source[@]} CVE-2014-1608.patch CVE-2014-1609.patch CVE-2014-6387.patch) sha1sums=(${sha1sums[@]} 'f89a1245b0883e0cd8a35f3d50f7e5f6442bd263' \ - '1e6ab8ddc7072be1e897ab5893be6af5ac96a334') + '1e6ab8ddc7072be1e897ab5893be6af5ac96a334' \ + 'd4e3bd72f44794ecf34e59267cbd9394698c60ed') # *********** - build() { Fcd ${pkgname}bt-$pkgver _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
