openembedded-core.git/meta/recipes-extended/unzip, branch master

unzip: add missing CVE headers to patches

2017-04-13T22:58:17+00:00

Signed-off-by: Ross Burton

unzip: CVE-2014-9913 CVE-2016-9844

2017-03-01T12:54:21+00:00

Backport the patches for CVE-2014-9913 CVE-2016-9844

CVE-2016-9844:
Buffer overflow in the zi_short function in zipinfo.c in Info-Zip
UnZip 6.0 allows remote attackers to cause a denial of service
(crash) via a large compression method value in the central
directory file header.
CVE-2014-9913:
Buffer overflow in the list_files function in list.c in Info-Zip
UnZip 6.0 allows remote attackers to cause a denial of service
(crash) via vectors related to the compression method.

Patches come from:
https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/archivers/unzip/  or
https://release.debian.org/proposed-updates/stable_diffs/unzip_6.0-16+deb8u3.debdiff

Bug-Debian: https://bugs.debian.org/847486
Bug-Ubuntu: https://launchpad.net/bugs/1643750

(LOCAL REV: NOT UPSTREAM) --send to oe-core on 20170222

Signed-off-by: Zhixiong Chi 
Signed-off-by: Ross Burton

unzip: fixes strange output

2016-09-03T08:58:27+00:00

This fixes commit 763a3d424bccf559a8d6add3dc1f2746c82f2933

Output was strange when using unzip to extract zip file.
This patch fixed so.

[YOCTO #9551]

Signed-off-by: Edwin Plauchu 
Signed-off-by: Richard Purdie

unzip: fix security issues

2016-06-01T07:04:12+00:00

This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security).

[YOCTO #9551]

Signed-off-by: Edwin Plauchu 
Signed-off-by: Richard Purdie

unzip: update SRC_URI

2016-05-19T21:31:34+00:00

The infozip FTP server appears to have been taken down, so change the SRC_URI to
point at their SourceForge project.

[ YOCTO #9655 ]

Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie

unzip: Explicitly set EXTRA_OEMAKE as required

2016-02-10T15:51:05+00:00

This recipe currently relies on EXTRA_OEMAKE having been set to
"-e MAKEFLAGS=" in bitbake.conf to operate. It is necessary to make this
explicit so that the default in bitbake.conf can be changed.

Signed-off-by: Mike Crowe 
Signed-off-by: Richard Purdie

Add "CVE:" tag to current patches in OE-core

2016-01-11T23:23:18+00:00

The currnet patches in OE-core doesn't have the "CVE:"
tag, now part of the policy of the patches.

This is patch add this tag to several patches. There might
be patches that I miss; the tag can be added in the future.

Signed-off-by: Mariano Lopez 
Signed-off-by: Ross Burton

package_regex.inc: split entries which blacklist specific versions to their recipes

2015-12-08T10:20:09+00:00

Signed-off-by: Alexander Kanavin 
Signed-off-by: Ross Burton

unzip: rename patch to reflect CVE fix

2015-11-16T11:32:43+00:00

Signed-off-by: Ross Burton

unzip: CVE-2015-7696, CVE-2015-7697

2015-11-02T12:25:41+00:00

CVE-2015-7696: Fixes a heap overflow triggered by unzipping a file with password
CVE-2015-7697: Fixes a denial of service with a file that never finishes unzipping

References:
http://www.openwall.com/lists/oss-security/2015/10/11/5
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7696
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7697

Signed-off-by: Tudor Florea 
Signed-off-by: Ross Burton 
Signed-off-by: Richard Purdie