This is an automated email from the git hooks/post-receive script.
tmancill pushed a commit to branch stretch
in repository libcommons-compress-java.
commit 68fba1efd66fa1d22ca4bc139f864205d9528478
Author: tony mancill <tmanc...@debian.org>
Date: Sun Apr 8 20:52:42 2018 -0700
Apply patch for CVE-2018-1324 (Closes: #893174)
---
debian/patches/CVE-2018-1324.patch | 17 +++++++++++++++++
debian/patches/series | 1 +
2 files changed, 18 insertions(+)
diff --git a/debian/patches/CVE-2018-1324.patch
b/debian/patches/CVE-2018-1324.patch
new file mode 100644
index 0000000..7ab678f
--- /dev/null
+++ b/debian/patches/CVE-2018-1324.patch
@@ -0,0 +1,17 @@
+Description: CVE-2018-1324
+Author: Stefan Bodewig <bode...@apache.org>
+Forwarded: not-needed
+Source:
https://git-wip-us.apache.org/repos/asf?p=commons-compress.git;a=blobdiff;f=src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java;h=acc3b22346b49845e85b5ef27a5814b69e834139;hp=0feb9c98cc622cde1defa3bbd268ef82b4ae5c18;hb=2a2f1dc48e22a34ddb72321a4db211da91aa933b;hpb=dcb0486fb4cb2b6592c04d6ec2edbd3f690df5f2
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893174
+
+---
a/src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java
++++
b/src/main/java/org/apache/commons/compress/archivers/zip/X0017_StrongEncryptionHeader.java
+@@ -310,7 +310,7 @@ public class X0017_StrongEncryptionHeader extends
PKWareExtraHeader {
+ this.hashAlg =
HashAlgorithm.getAlgorithmByCode(ZipShort.getValue(data, offset + 12));
+ this.hashSize = ZipShort.getValue(data, offset + 14);
+ // srlist... hashed public keys
+- for (int i = 0; i < this.rcount; i++) {
++ for (long i = 0; i < this.rcount; i++) {
+ for (int j = 0; j < this.hashSize; j++) {
+ // ZipUtil.signedByteToUnsignedInt(data[offset + 16 + (i
* this.hashSize) + j]));
+ }
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..3df6607
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+CVE-2018-1324.patch
--
Alioth's /usr/local/bin/git-commit-notice on
/srv/git.debian.org/git/pkg-java/libcommons-compress-java.git
_______________________________________________
pkg-java-commits mailing list
pkg-java-comm...@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-commits
