Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=d8576e0754d12848c5fe2d68e127e3ab5426b6a0
commit d8576e0754d12848c5fe2d68e127e3ab5426b6a0 Author: kikadf <[email protected]> Date: Fri Dec 12 09:45:55 2014 +0100 graphviz-2.28.0-2arcturus3-x86_64 * Fix CVE-2014-9157 diff --git a/source/xapps-extra/graphviz/CVE-2014-9157.patch b/source/xapps-extra/graphviz/CVE-2014-9157.patch new file mode 100644 index 0000000..6a83d1a --- /dev/null +++ b/source/xapps-extra/graphviz/CVE-2014-9157.patch @@ -0,0 +1,21 @@ +Subject: Fix format string vulnerability (CVE-2014-9157) in yyerror() routine +Origin: https://github.com/ellson/graphviz/commit/99eda421f7ddc27b14e4ac1d2126e5fe41719081 +Author: Emden R. Gansner + +--- + lib/cgraph/scan.l | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: b/lib/cgraph/scan.l +=================================================================== +--- a/lib/cgraph/scan.l ++++ b/lib/cgraph/scan.l +@@ -223,7 +223,7 @@ + agxbput (&xb, buf); + agxbput (&xb, yytext); + agxbput (&xb,"'\n"); +- agerr(AGWARN,agxbuse(&xb)); ++ agerr(AGWARN, "%s", agxbuse(&xb)); + agxbfree(&xb); + } + /* must be here to see flex's macro defns */ diff --git a/source/xapps-extra/graphviz/FrugalBuild b/source/xapps-extra/graphviz/FrugalBuild index ef49d58..87851f0 100644 --- a/source/xapps-extra/graphviz/FrugalBuild +++ b/source/xapps-extra/graphviz/FrugalBuild @@ -6,7 +6,7 @@ options+=('asneeded') pkgname=graphviz pkgver=2.28.0 -pkgrel=2arcturus2 +pkgrel=2arcturus3 pkgdesc="Open Source Graph Visualization Software" url="http://www.graphviz.org/"; depends=('libxml2>=2.7.8' 'fontconfig' 'python>=2.7' 'libjpeg>=8a' 'libpng>=1.4.1' 'ruby>=1.9.1' 'libtool' 'tk' 'guile' 'ocaml' 'libxaw>=1.0.5' 'libstdc++' 'pango>=1.24.2-2' 'cairo>=1.10.2') @@ -19,9 +19,11 @@ source=(http://www.graphviz.org/pub/graphviz/ARCHIVE/$pkgname-$pkgver.tar.gz) sha1sums=('4725d88a13e071ee22e632de551d4a55ca08ee7d') # FSA fix *** -source=(${source[@]} CVE-2014-0978.patch CVE-2014-1236.patch) +source=(${source[@]} CVE-2014-0978.patch CVE-2014-1236.patch CVE-2014-9157.patch) sha1sums=(${sha1sums[@]} '90f13a14dc688c09b7c3a8cedab73f2bc6f1065a' \ - 'a4ffb1f657bbea48388238a763e1269b07abc476') + 'a4ffb1f657bbea48388238a763e1269b07abc476' \ + 'eaff4102ff415ebb09c3309a22a5dce27d4983a5') + # *********** build() { _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
