Hello community,

here is the log from the commit of package optipng for openSUSE:Factory checked 
in at 2017-11-20 17:06:58
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/optipng (Old)
 and      /work/SRC/openSUSE:Factory/.optipng.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "optipng"

Mon Nov 20 17:06:58 2017 rev:34 rq:543842 version:0.7.6

Changes:
--------
--- /work/SRC/openSUSE:Factory/optipng/optipng.changes  2016-04-06 
11:52:51.000000000 +0200
+++ /work/SRC/openSUSE:Factory/.optipng.new/optipng.changes     2017-11-20 
17:07:28.949252300 +0100
@@ -1,0 +2,7 @@
+Mon Nov 20 10:28:38 UTC 2017 - pgaj...@suse.com
+
+- security update:
+  * CVE-2017-1000229 [bsc#1068720]
+    + optipng-CVE-2017-1000229.patch
+
+-------------------------------------------------------------------

New:
----
  optipng-CVE-2017-1000229.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ optipng.spec ++++++
--- /var/tmp/diff_new_pack.lLXJX7/_old  2017-11-20 17:07:29.565230000 +0100
+++ /var/tmp/diff_new_pack.lLXJX7/_new  2017-11-20 17:07:29.569229855 +0100
@@ -1,7 +1,7 @@
 #
 # spec file for package optipng
 #
-# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -25,6 +25,7 @@
 Url:            http://optipng.sourceforge.net/
 Source0:        
http://downloads.sourceforge.net/project/optipng/OptiPNG/optipng-%{version}/optipng-%{version}.tar.gz
 Source1:        macros.optipng
+Patch0:         optipng-CVE-2017-1000229.patch
 BuildRequires:  libpng-devel
 BuildRequires:  zlib-devel
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
@@ -37,6 +38,7 @@
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 # not autotools generated configure

++++++ optipng-CVE-2017-1000229.patch ++++++
>From 77ac8e9fd9b2c1aeec3951e2bb50f7cc2c1e92d2 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebast...@pipping.org>
Date: Sun, 19 Nov 2017 16:04:26 +0100
Subject: [PATCH] Prevent integer overflow (bug #65, CVE-2017-1000229)

---
 src/minitiff/tiffread.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/minitiff/tiffread.c b/src/minitiff/tiffread.c
index b4910ec..5f9b376 100644
--- a/src/minitiff/tiffread.c
+++ b/src/minitiff/tiffread.c
@@ -350,6 +350,8 @@ minitiff_read_info(struct minitiff_info *tiff_ptr, FILE *fp)
         count = tiff_ptr->strip_offsets_count;
         if (count == 0 || count > tiff_ptr->height)
             goto err_invalid;
+        if (count > (size_t)-1 / sizeof(long))
+            goto err_memory;
         tiff_ptr->strip_offsets = (long *)malloc(count * sizeof(long));
         if (tiff_ptr->strip_offsets == NULL)
             goto err_memory;
-- 
2.14.2


Reply via email to