Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=6a5a12c9eaf5483c5a15bf15baf677bb712c0b6c
commit 6a5a12c9eaf5483c5a15bf15baf677bb712c0b6c Author: kikadf <[email protected]> Date: Wed Nov 5 10:20:12 2014 +0100 php-5.3.26-2arcturus7-x86_64 * Fix CVE-2014-3668, CVE-2014-3669, CVE-2014-3670, CVE-2014-3710 diff --git a/source/devel/php/CVE-2014-3668.patch b/source/devel/php/CVE-2014-3668.patch new file mode 100644 index 0000000..c2f622f --- /dev/null +++ b/source/devel/php/CVE-2014-3668.patch @@ -0,0 +1,117 @@ +From 44035de79f5b9646064d9bdd0329a946b0c5372a Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Sun, 28 Sep 2014 17:33:44 -0700 +Subject: [PATCH] Fix bug #68027 - fix date parsing in XMLRPC lib + +--- + ext/xmlrpc/libxmlrpc/xmlrpc.c | 13 ++++++++----- + ext/xmlrpc/tests/bug68027.phpt | 44 ++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 52 insertions(+), 5 deletions(-) + create mode 100644 ext/xmlrpc/tests/bug68027.phpt + +diff --git a/ext/xmlrpc/libxmlrpc/xmlrpc.c b/ext/xmlrpc/libxmlrpc/xmlrpc.c +index ce70c2a..b766a54 100644 +--- a/ext/xmlrpc/libxmlrpc/xmlrpc.c ++++ b/ext/xmlrpc/libxmlrpc/xmlrpc.c +@@ -219,16 +219,19 @@ static int date_from_ISO8601 (const char *text, time_t * value) { + n = 10; + tm.tm_mon = 0; + for(i = 0; i < 2; i++) { +- XMLRPC_IS_NUMBER(text[i]) ++ XMLRPC_IS_NUMBER(text[i+4]) + tm.tm_mon += (text[i+4]-'0')*n; + n /= 10; + } + tm.tm_mon --; ++ if(tm.tm_mon < 0 || tm.tm_mon > 11) { ++ return -1; ++ } + + n = 10; + tm.tm_mday = 0; + for(i = 0; i < 2; i++) { +- XMLRPC_IS_NUMBER(text[i]) ++ XMLRPC_IS_NUMBER(text[i+6]) + tm.tm_mday += (text[i+6]-'0')*n; + n /= 10; + } +@@ -236,7 +239,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { + n = 10; + tm.tm_hour = 0; + for(i = 0; i < 2; i++) { +- XMLRPC_IS_NUMBER(text[i]) ++ XMLRPC_IS_NUMBER(text[i+9]) + tm.tm_hour += (text[i+9]-'0')*n; + n /= 10; + } +@@ -244,7 +247,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { + n = 10; + tm.tm_min = 0; + for(i = 0; i < 2; i++) { +- XMLRPC_IS_NUMBER(text[i]) ++ XMLRPC_IS_NUMBER(text[i+12]) + tm.tm_min += (text[i+12]-'0')*n; + n /= 10; + } +@@ -252,7 +255,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) { + n = 10; + tm.tm_sec = 0; + for(i = 0; i < 2; i++) { +- XMLRPC_IS_NUMBER(text[i]) ++ XMLRPC_IS_NUMBER(text[i+15]) + tm.tm_sec += (text[i+15]-'0')*n; + n /= 10; + } +diff --git a/ext/xmlrpc/tests/bug68027.phpt b/ext/xmlrpc/tests/bug68027.phpt +new file mode 100644 +index 0000000..a5c96f1 +--- /dev/null ++++ b/ext/xmlrpc/tests/bug68027.phpt +@@ -0,0 +1,44 @@ ++--TEST-- ++Bug #68027 (buffer overflow in mkgmtime() function) ++--SKIPIF-- ++<?php ++if (!extension_loaded("xmlrpc")) print "skip"; ++?> ++--FILE-- ++<?php ++ ++$d = '6-01-01 20:00:00'; ++xmlrpc_set_type($d, 'datetime'); ++var_dump($d); ++$datetime = "2001-0-08T21:46:40-0400"; ++$obj = xmlrpc_decode("<?xml version=\"1.0\"?><methodResponse><params><param><value><dateTime.iso8601>$datetime</dateTime.iso8601></value></param></params></methodResponse>"); ++print_r($obj); ++ ++$datetime = "34770-0-08T21:46:40-0400"; ++$obj = xmlrpc_decode("<?xml version=\"1.0\"?><methodResponse><params><param><value><dateTime.iso8601>$datetime</dateTime.iso8601></value></param></params></methodResponse>"); ++print_r($obj); ++ ++echo "Done\n"; ++?> ++--EXPECTF-- ++object(stdClass)#1 (3) { ++ ["scalar"]=> ++ string(16) "6-01-01 20:00:00" ++ ["xmlrpc_type"]=> ++ string(8) "datetime" ++ ["timestamp"]=> ++ int(%d) ++} ++stdClass Object ++( ++ [scalar] => 2001-0-08T21:46:40-0400 ++ [xmlrpc_type] => datetime ++ [timestamp] => %s ++) ++stdClass Object ++( ++ [scalar] => 34770-0-08T21:46:40-0400 ++ [xmlrpc_type] => datetime ++ [timestamp] => %d ++) ++Done +-- +2.1.0 + diff --git a/source/devel/php/CVE-2014-3669.patch b/source/devel/php/CVE-2014-3669.patch new file mode 100644 index 0000000..5266f37 --- /dev/null +++ b/source/devel/php/CVE-2014-3669.patch @@ -0,0 +1,56 @@ +From 9aa90145239bae82d2af0a99fdae4ab27eb5f4f2 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Sun, 28 Sep 2014 14:19:31 -0700 +Subject: [PATCH] Fixed bug #68044: Integer overflow in unserialize() (32-bits + only) + +--- + ext/standard/tests/serialize/bug68044.phpt | 12 ++++++++++++ + ext/standard/var_unserializer.c | 4 ++-- + ext/standard/var_unserializer.re | 2 +- + 3 files changed, 15 insertions(+), 3 deletions(-) + create mode 100644 ext/standard/tests/serialize/bug68044.phpt + +Index: php5-5.3.10/ext/standard/tests/serialize/bug68044.phpt +=================================================================== +--- /dev/null 1970-01-01 00:00:00.000000000 +0000 ++++ php5-5.3.10/ext/standard/tests/serialize/bug68044.phpt 2014-10-28 10:47:49.392858855 -0400 +@@ -0,0 +1,12 @@ ++--TEST-- ++Bug #68044 Integer overflow in unserialize() (32-bits only) ++--FILE-- ++<?php ++ echo unserialize('C:3:"XYZ":18446744075857035259:{}'); ++?> ++===DONE== ++--EXPECTF-- ++Warning: Insufficient data for unserializing - %d required, 1 present in %s/bug68044.php on line 2 ++ ++Notice: unserialize(): Error at offset 32 of 33 bytes in %s/bug68044.php on line 2 ++===DONE== +Index: php5-5.3.10/ext/standard/var_unserializer.c +=================================================================== +--- php5-5.3.10.orig/ext/standard/var_unserializer.c 2014-10-28 10:47:49.392858855 -0400 ++++ php5-5.3.10/ext/standard/var_unserializer.c 2014-10-28 10:47:49.392858855 -0400 +@@ -333,7 +333,7 @@ + + (*p) += 2; + +- if (datalen < 0 || (*p) + datalen >= max) { ++ if (datalen < 0 || (max - (*p)) <= datalen) { + zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p))); + return 0; + } +Index: php5-5.3.10/ext/standard/var_unserializer.re +=================================================================== +--- php5-5.3.10.orig/ext/standard/var_unserializer.re 2014-10-28 10:47:49.392858855 -0400 ++++ php5-5.3.10/ext/standard/var_unserializer.re 2014-10-28 10:47:49.392858855 -0400 +@@ -339,7 +339,7 @@ + + (*p) += 2; + +- if (datalen < 0 || (*p) + datalen >= max) { ++ if (datalen < 0 || (max - (*p)) <= datalen) { + zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p))); + return 0; + } diff --git a/source/devel/php/CVE-2014-3670.patch b/source/devel/php/CVE-2014-3670.patch new file mode 100644 index 0000000..bdba3b0 --- /dev/null +++ b/source/devel/php/CVE-2014-3670.patch @@ -0,0 +1,40 @@ +From ddb207e7fa2e9adeba021a1303c3781efda5409b Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Sun, 28 Sep 2014 16:57:42 -0700 +Subject: [PATCH] Fix bug #68113 (Heap corruption in exif_thumbnail()) + +--- + create mode 100755 ext/exif/tests/bug68113.jpg + create mode 100644 ext/exif/tests/bug68113.phpt + +From ddb207e7fa2e9adeba021a1303c3781efda5409b Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <[email protected]> +Date: Sun, 28 Sep 2014 16:57:42 -0700 +Subject: [PATCH] Fix bug #68113 (Heap corruption in exif_thumbnail()) + +--- + ext/exif/exif.c | 4 ++-- + ext/exif/tests/bug68113.jpg | Bin 0 -> 368 bytes + ext/exif/tests/bug68113.phpt | 17 +++++++++++++++++ + 3 files changed, 19 insertions(+), 2 deletions(-) + create mode 100755 ext/exif/tests/bug68113.jpg + create mode 100644 ext/exif/tests/bug68113.phpt + +Index: php5-5.3.10/ext/exif/exif.c +=================================================================== +--- php5-5.3.10.orig/ext/exif/exif.c 2014-10-28 10:48:06.317008432 -0400 ++++ php5-5.3.10/ext/exif/exif.c 2014-10-28 10:48:06.317008432 -0400 +@@ -2446,11 +2446,11 @@ + data_ptr += 8; + break; + case TAG_FMT_SINGLE: +- memmove(data_ptr, &info_data->value.f, byte_count); ++ memmove(data_ptr, &info_value->f, 4); + data_ptr += 4; + break; + case TAG_FMT_DOUBLE: +- memmove(data_ptr, &info_data->value.d, byte_count); ++ memmove(data_ptr, &info_value->d, 8); + data_ptr += 8; + break; + } diff --git a/source/devel/php/CVE-2014-3710.patch b/source/devel/php/CVE-2014-3710.patch new file mode 100644 index 0000000..1f87673 --- /dev/null +++ b/source/devel/php/CVE-2014-3710.patch @@ -0,0 +1,34 @@ +From 5b295bf19161b14d6c81151fd89c2f17bd50525c Mon Sep 17 00:00:00 2001 +From: Remi Collet <[email protected]> +Date: Wed, 22 Oct 2014 15:37:04 +0200 +Subject: [PATCH] Fix bug #68283: fileinfo: out-of-bounds read in elf note + headers + +Upstream commit +https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0 + +CVE -2014-3710 + +(cherry picked from commit 1803228597e82218a8c105e67975bc50e6f5bf0d) +--- + ext/fileinfo/libmagic/readelf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +Index: php5-5.3.10/ext/fileinfo/libmagic/readelf.c +=================================================================== +--- php5-5.3.10.orig/ext/fileinfo/libmagic/readelf.c 2014-10-28 10:48:25.485177792 -0400 ++++ php5-5.3.10/ext/fileinfo/libmagic/readelf.c 2014-10-28 10:48:25.485177792 -0400 +@@ -375,6 +375,13 @@ + #endif + uint32_t namesz, descsz; + ++ if (xnh_sizeof + offset > size) { ++ /* ++ * We're out of note headers. ++ */ ++ return xnh_sizeof + offset; ++ } ++ + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); + offset += xnh_sizeof; + diff --git a/source/devel/php/FrugalBuild b/source/devel/php/FrugalBuild index 0e7d4be..50f89b5 100644 --- a/source/devel/php/FrugalBuild +++ b/source/devel/php/FrugalBuild @@ -4,7 +4,7 @@ pkgname=php pkgver=5.3.26 -pkgrel=2arcturus6 +pkgrel=2arcturus7 pkgdesc="A widely-used general-purpose scripting language" url="http://www.php.net"; backup=(etc/{php.ini,httpd/conf/modules.d/$pkgname.conf}) @@ -17,7 +17,8 @@ groups=('devel') archs=('i686' 'x86_64') up2date="lynx -dump http://www.php.net/downloads.php | grep 'Complete Source Code' -B2 | awk '/stable/ {print \$2}'" #source=(http://www.php.net/distributions/$pkgname-$pkgver.tar.gz \ -source=(http://museum.php.net/php5/$pkgname-$pkgver.tar.gz \ +#source=(http://museum.php.net/php5/$pkgname-$pkgver.tar.gz \ +source=(ftp://ftp.frugalware.org/pub/frugalware/frugalware-1.9/source/devel/php/php-5.3.26.tar.gz \ autoconf_259.patch php.ini php.conf README.Frugalware phpize.in.patch) sha1sums=('99e8094051f94b0a03b05fa9d4cbe0794ee3ac4f' \ 'c99534745f4dee26446c9e6f42e35a0c85ce961b' \ @@ -41,7 +42,9 @@ source=(${source[@]} CVE-2013-4113.patch CVE-2013-4248.patch CVE-2013-6420.patch CVE-2014-0207.patch CVE-2014-3478.patch CVE-2014-3479.patch CVE-2014-3480.patch CVE-2014-3487.patch CVE-2014-4721.patch CVE-2014-3538.patch CVE-2014-3587.patch - CVE-2014-4670.patch CVE-2014-4049.patch CVE-2014-4698.patch) + CVE-2014-4670.patch CVE-2014-4049.patch CVE-2014-4698.patch + CVE-2014-3668.patch CVE-2014-3669.patch CVE-2014-3670.patch + CVE-2014-3710.patch) sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ 'b75fe24356d0e6c5d375c4d2d2315f17d5e34e31' \ '805231398c06b27e4e1f8c18ce9d6aed7b06382d' \ @@ -61,7 +64,11 @@ sha1sums=(${sha1sums[@]} '7b9f92b247bf141012b4a83d5bad1b823e4eb2d1' \ '4739e1eab6f4522d91ecb05492e0430fbd28f42e' \ '34be06874a03c0b0d349d817af18059b92f4ec0e' \ 'a3fa0995e26e03681f0ce20289587645e6a4e401' \ - '9c8ac4ba948c0feabc8c75e4f58ca3f775bb094f') + '9c8ac4ba948c0feabc8c75e4f58ca3f775bb094f' \ + '4672c18ece397b2f99ad0c992f61220e210b2dc1' \ + '454e96af5cab1f649fceca61c0afb46ae73179f5' \ + '2f368143bcdaae4659a65103ffdeb71cac12c5cf' \ + '0e75bc9b4c66ce0f4b34c3c77c384b15868fa8a6') # *********** _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
