helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-04-02 02:49:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

procmail: patch CVE-2014-3618

Browse Source 
Take patch from Debian.
https://sources.debian.org/data/main/p/procmail/3.22-20%2Bdeb7u1/debian/patches/CVE-2014-3618.patch

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Peter Marko 2024-12-27 11:56:04 +01:00 committed by Khem Raj
parent 9fff0040f1
commit 8378820dab
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
meta-oe/recipes-support/procmail/procmail/CVE-2014-3618.patch Normal file
View File

@ -0,0 +1,29 @@
Description: Fix heap-overflow in formail
CVE-2014-3618: Heap-overflow in formail when processing
specially-crafted email headers.
Origin: http://www.openwall.com/lists/oss-security/2014/09/03/8
Bug-Debian: https://bugs.debian.org/704675
Bug-Debian: https://bugs.debian.org/760443
Forwarded: not-needed
Last-Update: 2014-09-04
CVE: CVE-2014-3618
Upstream-Status: Inactive-Upstream [lastrelease: 2001]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
--- a/src/formisc.c
+++ b/src/formisc.c
@@ -84,12 +84,11 @@ normal: *target++= *start++;
case '"':*target++=delim='"';start++;
}
;{ int i;
- do
+ while(*start)
if((i= *target++= *start++)==delim) /* corresponding delimiter? */
break;
else if(i=='\\'&&*start) /* skip quoted character */
*target++= *start++;
- while(*start); /* anything? */
}
hitspc=2;
}

4
meta-oe/recipes-support/procmail/procmail_3.22.bb
View File

@ -12,7 +12,9 @@ SRC_URI = "http://www.ring.gr.jp/archives/net/mail/${BPN}/${BP}.tar.gz \
file://from-debian-to-fix-compile-errors.patch \
file://from-debian-to-modify-parameters.patch \
file://from-debian-to-fix-man-file.patch \
file://man-file-mailstat.1-from-debian.patch"
file://man-file-mailstat.1-from-debian.patch \
file://CVE-2014-3618.patch \
"
SRC_URI[sha256sum] = "087c75b34dd33d8b9df5afe9e42801c9395f4bf373a784d9bc97153b0062e117"
LICENSE = "GPL-2.0-only & Artistic-1.0"