Hello community,
here is the log from the commit of package elfutils for openSUSE:Factory
checked in at 2015-01-10 23:04:51
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/elfutils (Old)
and /work/SRC/openSUSE:Factory/.elfutils.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "elfutils"
Changes:
--------
--- /work/SRC/openSUSE:Factory/elfutils/elfutils.changes 2014-12-01
14:00:27.000000000 +0100
+++ /work/SRC/openSUSE:Factory/.elfutils.new/elfutils.changes 2015-01-10
23:04:53.000000000 +0100
@@ -1,0 +2,27 @@
+Wed Jan 7 21:19:10 UTC 2015 - to...@suse.com
+
+- CVE-2014-9447: elfutils: Directory traversal vulnerability (bnc#911662)
+ Add patch: elfutils-fix-dir-traversal-vuln-in-ar-extraction.patch
+
+-------------------------------------------------------------------
+Wed Jan 7 00:45:34 UTC 2015 - p.drou...@gmail.com
+
+- Update to version 0.161
+ + libdw: New function dwarf_peel_type. dwarf_aggregate_size now uses
+ dwarf_peel_type to also provide the sizes of qualified types.
+ dwarf_getmacros will now serve either of .debug_macro and
+ .debug_macinfo transparently. New interfaces
+ dwarf_getmacros_off, dwarf_macro_getsrcfiles,
+ dwarf_macro_getparamcnt, and dwarf_macro_param are available
+ for more generalized inspection of macros and their parameters.
+ dwarf.h: Add DW_AT_GNU_deleted, DW_AT_noreturn, DW_LANG_C11,
+ DW_LANG_C_plus_plus_11 and DW_LANG_C_plus_plus_14.
+- Remove merged patches
+ + elfutils-robustify.patch
+ + elfutils-no-po-test-build.diff
+ + elfutils-check-for-overflow-before-calling-malloc-to-uncompress-data.patch
+- Refreshed patch (from Fedora sources)
+ + elfutils-portability.patch > elfutils-portability-0.161.patch
+- Add a lang subpackage
+
+-------------------------------------------------------------------
Old:
----
elfutils-0.158.tar.bz2
elfutils-check-for-overflow-before-calling-malloc-to-uncompress-data.patch
elfutils-no-po-test-build.diff
elfutils-portability.patch
elfutils-robustify.patch
New:
----
elfutils-0.161.tar.bz2
elfutils-fix-dir-traversal-vuln-in-ar-extraction.patch
elfutils-portability-0.161.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ elfutils.spec ++++++
--- /var/tmp/diff_new_pack.AbRUag/_old 2015-01-10 23:04:54.000000000 +0100
+++ /var/tmp/diff_new_pack.AbRUag/_new 2015-01-10 23:04:54.000000000 +0100
@@ -1,7 +1,7 @@
#
# spec file for package elfutils
#
-# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +17,7 @@
Name: elfutils
-Version: 0.158
+Version: 0.161
Release: 0
Summary: Higher-level library to access ELF
License: SUSE-GPL-2.0-with-OSI-exception
@@ -29,21 +29,20 @@
Source1: README-BEFORE-ADDING-PATCHES
Source2: baselibs.conf
Source3: %{name}.changes
-Patch1:
https://fedorahosted.org/releases/e/l/%{name}/%{version}/elfutils-portability.patch
-Patch2:
https://fedorahosted.org/releases/e/l/%{name}/%{version}/elfutils-robustify.patch
-Patch3: elfutils-no-po-test-build.diff
-Patch4: libebl-prototype-fix.diff
-Patch5: elfutils-uninitialized.diff
-Patch6: elfutils-0.137-dwarf-header-check-fix.diff
-Patch7: elfutils-0.148-dont-crash.diff
-Patch8: elfutils-revert-portability-scanf.patch
-Patch9:
elfutils-check-for-overflow-before-calling-malloc-to-uncompress-data.patch
+Patch1:
https://fedorahosted.org/releases/e/l/%{name}/%{version}/elfutils-portability-%{version}.patch
+Patch2: elfutils-revert-portability-scanf.patch
+Patch3: libebl-prototype-fix.diff
+Patch4: elfutils-uninitialized.diff
+Patch5: elfutils-0.137-dwarf-header-check-fix.diff
+Patch6: elfutils-0.148-dont-crash.diff
+Patch7: elfutils-fix-dir-traversal-vuln-in-ar-extraction.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: bison
BuildRequires: flex
BuildRequires: libbz2-devel
BuildRequires: xz-devel
BuildRequires: zlib-devel
+Recommends: %{name}.lang
%description
This package provides a higher-level library to access ELF files. This
@@ -138,17 +137,17 @@
This package contains all necessary include files and libraries needed
to develop applications that require these.
+%lang_package
+
%prep
%setup -q
%patch1 -p1
-%patch2 -p1
+%patch2 -p1 -R
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
-%patch8 -p1 -R
-%patch9 -p1
%build
# Change DATE/TIME macros to use last change time of elfutils.changes
@@ -169,6 +168,7 @@
# remove unneeded files
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
ls -lR $RPM_BUILD_ROOT%{_libdir}/libelf*
+%find_lang %{name}
%post -n libebl1 -p /sbin/ldconfig
@@ -237,6 +237,9 @@
%{_includedir}/dwarf.h
%dir %{_includedir}/elfutils
%{_includedir}/elfutils/libdw.h
+%{_includedir}/elfutils/libdwelf.h
%{_includedir}/elfutils/libdwfl.h
+%files lang -f %{name}.lang
+
%changelog
++++++ elfutils-0.137-dwarf-header-check-fix.diff ++++++
--- /var/tmp/diff_new_pack.AbRUag/_old 2015-01-10 23:04:54.000000000 +0100
+++ /var/tmp/diff_new_pack.AbRUag/_new 2015-01-10 23:04:54.000000000 +0100
@@ -16,14 +16,14 @@
--- a/libdw/dwarf_getsrclines.c
+++ b/libdw/dwarf_getsrclines.c
-@@ -306,8 +306,10 @@ dwarf_getsrclines (Dwarf_Die *cudie, Dwa
- /* Consistency check. */
- if (unlikely (linep != header_start + header_length))
- {
+@@ -293,8 +293,10 @@
+ /* Consistency check. */
+ if (unlikely (linep != header_start + header_length))
+ {
+#if 0
- __libdw_seterrno (DWARF_E_INVALID_DWARF);
- goto out;
+ __libdw_seterrno (DWARF_E_INVALID_DWARF);
+ goto out;
+#endif
- }
+ }
- /* We are about to process the statement program. Initialize the
+ /* We are about to process the statement program. Initialize the
++++++ elfutils-0.158.tar.bz2 -> elfutils-0.161.tar.bz2 ++++++
++++ 68282 lines of diff (skipped)
++++++ elfutils-fix-dir-traversal-vuln-in-ar-extraction.patch ++++++
From: Alexander Cherepanov <chere...@mccme.ru>
Subject: libelf: Fix dir traversal vuln in ar extraction
Date: Sun Dec 28 19:57:19 2014 +0300
Git-commit: 147018e729e7c22eeabf15b82d26e4bf68a0d18e
References: bnc#911662, CVE-2014-9447
Signed-off-by: Tony Jones <to...@suse.de>
libelf: Fix dir traversal vuln in ar extraction.
read_long_names terminates names at the first '/' found but then skips
one character without checking (it's supposed to be '\n'). Hence the
next name could start with any character including '/'. This leads to
a directory traversal vulnerability at the time the contents of the
archive is extracted.
The danger is mitigated by the fact that only one '/' is possible in a
resulting filename and only in the leading position. Hence only files
in the root directory can be written via this vuln and only when ar is
executed as root.
The fix for the vuln is to not skip any characters while looking
for '/'.
Signed-off-by: Alexander Cherepanov <chere...@mccme.ru>
diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 3b88d03..447c354 100644
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-28 Alexander Cherepanov <chere...@mccme.ru>
+
+ * elf_begin.c (read_long_names): Don't miss '/' right after
+ another '/'. Fixes a dir traversal vuln in ar extraction.
+
2014-12-18 Ulrich Drepper <drep...@gmail.com>
* Makefile.am: Suppress output of textrel_check command.
diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index 30abe0b..cd3756c 100644
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -749,10 +749,7 @@ read_long_names (Elf *elf)
}
/* NUL-terminate the string. */
- *runp = '\0';
-
- /* Skip the NUL byte and the \012. */
- runp += 2;
+ *runp++ = '\0';
/* A sanity check. Somebody might have generated invalid
archive. */
++++++ elfutils-portability-0.161.patch ++++++
++++ 1929 lines (skipped)
--
To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org
For additional commands, e-mail: opensuse-commit+h...@opensuse.org
