From: Armin Kuster <[email protected]> CVE-2015-8560 cups-filters: foomatic-rip did not consider semicolon as illegal shell escape character
(From OE-Core rev: 307056ce062bf4063f6effeb4c891c82c949c053) Signed-off-by: Armin Kuster <[email protected]> Signed-off-by: Richard Purdie <[email protected]> Signed-off-by: Armin Kuster <[email protected]> --- .../foomatic-filters-4.0.17/CVE-2015-8560.patch | 23 ++++++++++++++++++++++ .../foomatic/foomatic-filters_4.0.17.bb | 3 +++ 2 files changed, 26 insertions(+) create mode 100644 meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch diff --git a/meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch b/meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch new file mode 100644 index 0000000..dc973c4 --- /dev/null +++ b/meta/recipes-extended/foomatic/foomatic-filters-4.0.17/CVE-2015-8560.patch @@ -0,0 +1,23 @@ +Upstream-Status: Backport + + +http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7419 + +Hand applied change to util.c. Fix was for cups-filters but also applied to foomatic-filters. + +CVE: CVE-2015-8560 +Signed-off-by: Armin Kuster <[email protected]> + +Index: util.c +=================================================================== +--- a/util.c ++++ b/util.c +@@ -31,7 +31,7 @@ + #include <assert.h> + + +-const char* shellescapes = "|<>&!$\'\"#*?()[]{}"; ++const char* shellescapes = "|;<>&!$\'\"#*?()[]{}"; + + const char * temp_dir() + { diff --git a/meta/recipes-extended/foomatic/foomatic-filters_4.0.17.bb b/meta/recipes-extended/foomatic/foomatic-filters_4.0.17.bb index 0cffedd..497d2bf 100644 --- a/meta/recipes-extended/foomatic/foomatic-filters_4.0.17.bb +++ b/meta/recipes-extended/foomatic/foomatic-filters_4.0.17.bb @@ -17,6 +17,9 @@ LIC_FILES_CHKSUM = "file://${WORKDIR}/foomatic-filters-${PV}/COPYING;md5=393a5ca SRC_URI = "http://www.openprinting.org/download/foomatic/foomatic-filters-${PV}.tar.gz"; +SRC_URI += "file://CVE-2015-8560.patch \ + " + SRC_URI[md5sum] = "b05f5dcbfe359f198eef3df5b283d896" SRC_URI[sha256sum] = "a2e2e53e502571e88eeb9010c45a0d54671f15707ee104f5c9c22b59ea7a33e3" -- 2.3.5 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
