Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=865dc21a9e77ebba8d21452a5c5eaf44c2b10a00
commit 865dc21a9e77ebba8d21452a5c5eaf44c2b10a00 Author: kikadf <[email protected]> Date: Wed Nov 5 10:00:51 2014 +0100 qemu-1.6.1-8-x86_64 * Fix CVE-2014-3689, CVE-2014-7815 diff --git a/source/xapps-extra/qemu/CVE-2014-3689.patch b/source/xapps-extra/qemu/CVE-2014-3689.patch new file mode 100644 index 0000000..62ba62a --- /dev/null +++ b/source/xapps-extra/qemu/CVE-2014-3689.patch @@ -0,0 +1,34 @@ +From: Gerd Hoffmann <[email protected]> +Date: Wed, 29 Oct 2014 12:56:06 +0100 +Subject: [PATCH] vmware-vga: CVE-2014-3689: turn off hw accel + +Quick & easy stopgap for CVE-2014-3689: We just compile out the +hardware acceleration functions which lack sanity checks. Thankfully +we have capability bits for them (SVGA_CAP_RECT_COPY and +SVGA_CAP_RECT_FILL), so guests should deal just fine, in theory. + +Subsequent patches will add the missing checks and re-enable the +hardware acceleration emulation. + +Cc: [email protected] +Signed-off-by: Gerd Hoffmann <[email protected]> +Reviewed-by: Don Koch <[email protected]> +--- + hw/display/vmware_vga.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c +index a6a8cdc..113ce1f 100644 +--- a/hw/display/vmware_vga.c ++++ b/hw/display/vmware_vga.c +@@ -27,8 +27,10 @@ + #include "hw/pci/pci.h" + + #undef VERBOSE ++#if 0 + #define HW_RECT_ACCEL + #define HW_FILL_ACCEL ++#endif + #define HW_MOUSE_ACCEL + + #include "vga_int.h" diff --git a/source/xapps-extra/qemu/CVE-2014-7815.patch b/source/xapps-extra/qemu/CVE-2014-7815.patch new file mode 100644 index 0000000..dbebb5d --- /dev/null +++ b/source/xapps-extra/qemu/CVE-2014-7815.patch @@ -0,0 +1,45 @@ +From: Petr Matousek <[email protected]> +Date: Mon, 27 Oct 2014 12:41:44 +0100 +Subject: [PATCH] vnc: sanitize bits_per_pixel from the client + +bits_per_pixel that are less than 8 could result in accessing +non-initialized buffers later in the code due to the expectation +that bytes_per_pixel value that is used to initialize these buffers is +never zero. + +To fix this check that bits_per_pixel from the client is one of the +values that the rfb protocol specification allows. + +This is CVE-2014-7815. + +Signed-off-by: Petr Matousek <[email protected]> + +[ kraxel: apply codestyle fix ] + +Signed-off-by: Gerd Hoffmann <[email protected]> +(cherry picked from commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829) +--- + ui/vnc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/ui/vnc.c b/ui/vnc.c +index 5601cc3..edd514e 100644 +--- a/ui/vnc.c ++++ b/ui/vnc.c +@@ -2024,6 +2024,16 @@ static void set_pixel_format(VncState *vs, + return; + } + ++ switch (bits_per_pixel) { ++ case 8: ++ case 16: ++ case 32: ++ break; ++ default: ++ vnc_client_error(vs); ++ return; ++ } ++ + vs->client_pf.rmax = red_max; + vs->client_pf.rbits = hweight_long(red_max); + vs->client_pf.rshift = red_shift; diff --git a/source/xapps-extra/qemu/FrugalBuild b/source/xapps-extra/qemu/FrugalBuild index bbb5af9..e5e6ace 100644 --- a/source/xapps-extra/qemu/FrugalBuild +++ b/source/xapps-extra/qemu/FrugalBuild @@ -9,7 +9,7 @@ USE_DEVEL=${USE_DEVEL:-"n"} pkgname=qemu pkgver=1.6.1 Fuse $USE_DEVEL && pkgver=svn6369 -pkgrel=7 +pkgrel=8 Fuse $USE_DEVEL && pkgrel=1 pkgdesc="QEMU is a FAST! processor emulator" url="http://www.nongnu.org/qemu/"; @@ -49,13 +49,16 @@ TARGETS="i386-softmmu x86_64-softmmu arm-softmmu" # FSA fix *** source=(${source[@]} CVE-2013-4375.patch CVE-2014-0150.patch CVE-2013-4544.patch - CVE-2014-2894.patch CVE-2014-3640.patch CVE-2014-3615.patch) + CVE-2014-2894.patch CVE-2014-3640.patch CVE-2014-3615.patch + CVE-2014-3689.patch CVE-2014-7815.patch) sha1sums=(${sha1sums[@]} '761b353dbbd110fd8e75e0e5f471effdc8e37beb' \ '21f8788763786778efff306e07d0f0dc64aabb36' \ 'f878bda3babc020d8c36b63b8c938acffc0bf29e' \ 'ed600afeed4df631f5adc2bc6cc353ee691ec432' \ '47a312a667488b3be2c94ea2c7bb5bdcb923f247' \ - '3fe6dce9a5daac9088fdfdea86cfae3ab5c05f81') + '3fe6dce9a5daac9088fdfdea86cfae3ab5c05f81' \ + '1beb3322a61033344c0f6a80019160c26052872a' \ + 'dc3bf6ed322dfd24e4e7fc5031b2d19f27112ce4') # *********** build() _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
