update to new version 5.36
Resolves: CVE-2019-8907 - remote denial of service in do_core_note in readelf.c Resolves: CVE-2019-8905 - stack-based buffer over-read in do_core_note in readelf.c Resolves: CVE-2019-8904 - stack-based buffer over-read in do_bid_note in readelf.c Resolves: CVE-2019-8906 - out-of-bounds read in do_core_note in readelf.c Closes #6
This commit is contained in:
Siteshwar Vashisht
Kamil Dudka
parent
3b07fcd19d
commit
325a9464bc
@ -1,26 +0,0 @@
|
||||
From b675e1cf6c5f047a1ab52b7dcea3c83ea6aac69f Mon Sep 17 00:00:00 2001
|
||||
From: Christos Zoulas <christos@zoulas.com>
|
||||
Date: Fri, 9 Nov 2018 17:51:12 +0000
|
||||
Subject: [PATCH] Add eBPF magic from Matteo Croce
|
||||
|
||||
Upstream-commit: 4cf4e817457ce6ca32452a7c80b27e96be6441dc
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
magic/Magdir/elf | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/magic/Magdir/elf b/magic/Magdir/elf
|
||||
index 133bd1f..7c6011c 100644
|
||||
--- a/magic/Magdir/elf
|
||||
+++ b/magic/Magdir/elf
|
||||
@@ -263,6 +263,7 @@
|
||||
>18 leshort 217 iCelero CoolEngine,
|
||||
>18 leshort 218 Nanoradio Optimized RISC,
|
||||
>18 leshort 243 UCB RISC-V,
|
||||
+>18 leshort 247 eBPF,
|
||||
>18 leshort 0x1057 AVR (unofficial),
|
||||
>18 leshort 0x1059 MSP430 (unofficial),
|
||||
>18 leshort 0x1223 Adapteva Epiphany (unofficial),
|
||||
--
|
||||
2.17.2
|
||||
|
||||
@ -1,28 +0,0 @@
|
||||
From b7dc8766080bf6189d6f15f7887c80ac456e01b9 Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Dubaj <odubaj@redhat.com>
|
||||
Date: Thu, 24 Jan 2019 09:37:52 +0100
|
||||
Subject: [PATCH] Add Linux PowerPC core offsets for Linux + fixed bug #1161911
|
||||
|
||||
---
|
||||
src/readelf.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/readelf.c b/src/readelf.c
|
||||
index 909e414..642d6fd 100644
|
||||
--- a/src/readelf.c
|
||||
+++ b/src/readelf.c
|
||||
@@ -262,7 +262,10 @@ static const size_t prpsoffsets32[] = {
|
||||
84, /* SunOS 5.x (short name) */
|
||||
|
||||
44, /* Linux (command line) */
|
||||
- 28, /* Linux 2.0.36 (short name) */
|
||||
+ 28, /* Linux (short name) */
|
||||
+
|
||||
+ 48, /* Linux PowerPC (command line) */
|
||||
+ 32, /* Linux PowerPC (short name) */
|
||||
|
||||
8, /* FreeBSD */
|
||||
};
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@ -1,65 +0,0 @@
|
||||
From 3938a505b79d24ad76dc42151994740159cb8d60 Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Dubaj <odubaj@redhat.com>
|
||||
Date: Thu, 24 Jan 2019 08:36:04 +0100
|
||||
Subject: [PATCH] Fixed bug missidentifying netpbm files (#856092)
|
||||
|
||||
---
|
||||
magic/Magdir/images | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/magic/Magdir/images b/magic/Magdir/images
|
||||
index 5cd9fab..e16d028 100644
|
||||
--- a/magic/Magdir/images
|
||||
+++ b/magic/Magdir/images
|
||||
@@ -175,42 +175,42 @@
|
||||
>0 regex/4 P1[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, bitmap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-bitmap
|
||||
|
||||
0 search/1 P2
|
||||
>0 regex/4 P2[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, greymap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-greymap
|
||||
|
||||
0 search/1 P3
|
||||
>0 regex/4 P3[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, pixmap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-pixmap
|
||||
|
||||
0 string P4
|
||||
>0 regex/4 P4[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, rawbits, bitmap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-bitmap
|
||||
|
||||
0 string P5
|
||||
>0 regex/4 P5[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, rawbits, greymap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-greymap
|
||||
|
||||
0 string P6
|
||||
>0 regex/4 P6[\040\t\f\r\n]
|
||||
>>0 use netpbm
|
||||
>>0 string x \b, rawbits, pixmap
|
||||
-!:strength + 45
|
||||
+!:strength + 65
|
||||
!:mime image/x-portable-pixmap
|
||||
|
||||
0 string P7 Netpbm PAM image file
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@ -1,35 +0,0 @@
|
||||
From 59e7ca314411c4811bb1a15026531edacfd66f0e Mon Sep 17 00:00:00 2001
|
||||
From: Ondrej Dubaj <odubaj@redhat.com>
|
||||
Date: Tue, 4 Dec 2018 11:50:20 +0100
|
||||
Subject: [PATCH] Fixed bug misleading qcow2 v2 and v3 files (#1654349)
|
||||
|
||||
---
|
||||
magic/Magdir/virtual | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/magic/Magdir/virtual b/magic/Magdir/virtual
|
||||
index 26442bf..24c8b32 100644
|
||||
--- a/magic/Magdir/virtual
|
||||
+++ b/magic/Magdir/virtual
|
||||
@@ -36,7 +36,7 @@
|
||||
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
|
||||
# Made by reading sources, reading documentation, and doing trial and error
|
||||
# on existing QCOW files
|
||||
-0 string/b QFI\xFB QEMU QCOW Image
|
||||
+0 string/b QFI\xFB
|
||||
|
||||
# Uncomment the following line to display Magic (only used for debugging
|
||||
# this magic number)
|
||||
@@ -44,7 +44,8 @@
|
||||
|
||||
# There are currently 2 Versions: "1" and "2".
|
||||
# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
|
||||
->4 belong 1 (v1)
|
||||
+>4 belong !1 QEMU QCOW2 Image
|
||||
+>4 belong 1 QEMU QCOW Image (v1)
|
||||
|
||||
# Using the existence of the Backing File Offset to determine whether
|
||||
# to read Backing File Information
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@ -1,6 +0,0 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iEYEABECAAYFAlvJGcMACgkQcREqsWyzOzpYYQCgsAWYc53UEoPl3kkJpFPn7wzX
|
||||
IAQAnjfEPZBlmALT0+8OOy1jvP1Xgswb
|
||||
=wYfS
|
||||
-----END PGP SIGNATURE-----
|
||||
6
file-5.36.tar.gz.asc
Normal file
6
file-5.36.tar.gz.asc
Normal file
@ -0,0 +1,6 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iEYEABECAAYFAlxtcFoACgkQcREqsWyzOzp+cQCg1EKjv0nl2ecPjbh4wHffQ+Gz
|
||||
Y2kAn2eyPWcbVtM1rER2qBS7NSaRzhrW
|
||||
=J7wy
|
||||
-----END PGP SIGNATURE-----
|
||||
@ -1,11 +1,9 @@
|
||||
From f25107f625e88726e8ae9d4963573b5a0dda8f4c Mon Sep 17 00:00:00 2001
|
||||
From: Jan Kaluza <hanzz.k@gmail.com>
|
||||
Date: Thu, 15 Dec 2011 16:15:41 +0100
|
||||
Subject: [PATCH] file-localmagic.patch
|
||||
From 14569013793837d262084f3ac6260638d340f3bf Mon Sep 17 00:00:00 2001
|
||||
From: Siteshwar Vashisht <svashisht@redhat.com>
|
||||
Date: Thu, 21 Feb 2019 15:26:38 +0100
|
||||
Subject: [PATCH] Upstream says it's up to distributions to add a way to
|
||||
support local-magic.
|
||||
|
||||
Upstream says it's up to distributions to add a way to support local-magic.
|
||||
|
||||
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||
---
|
||||
magic/magic.local | 3 +++
|
||||
src/Makefile.am | 2 +-
|
||||
@ -24,7 +22,7 @@ index 0000000..283a863
|
||||
+# Insert here your local magic data. Format is described in magic(5).
|
||||
+
|
||||
diff --git a/src/Makefile.am b/src/Makefile.am
|
||||
index 155aec4..0f22539 100644
|
||||
index 2fbefdb..3ca3e73 100644
|
||||
--- a/src/Makefile.am
|
||||
+++ b/src/Makefile.am
|
||||
@@ -1,4 +1,4 @@
|
||||
@ -34,7 +32,7 @@ index 155aec4..0f22539 100644
|
||||
nodist_include_HEADERS = magic.h
|
||||
|
||||
diff --git a/src/Makefile.in b/src/Makefile.in
|
||||
index b6eeb20..78dce55 100644
|
||||
index 29567c4..8222bc1 100644
|
||||
--- a/src/Makefile.in
|
||||
+++ b/src/Makefile.in
|
||||
@@ -337,7 +337,7 @@ target_alias = @target_alias@
|
||||
@ -47,11 +45,11 @@ index b6eeb20..78dce55 100644
|
||||
nodist_include_HEADERS = magic.h
|
||||
AM_CPPFLAGS = -DMAGIC='"$(MAGIC)"'
|
||||
diff --git a/src/apprentice.c b/src/apprentice.c
|
||||
index e395854..ecc1214 100644
|
||||
index eca3ae0..24b5663 100644
|
||||
--- a/src/apprentice.c
|
||||
+++ b/src/apprentice.c
|
||||
@@ -454,7 +454,7 @@ apprentice_1(struct magic_set *ms, const char *fn, int action)
|
||||
if (map == (struct magic_map *)-1)
|
||||
if (map == RCAST(struct magic_map *, -1))
|
||||
return -1;
|
||||
if (map == NULL) {
|
||||
- if (ms->flags & MAGIC_CHECK)
|
||||
@ -60,5 +58,5 @@ index e395854..ecc1214 100644
|
||||
map = apprentice_load(ms, fn, action);
|
||||
if (map == NULL)
|
||||
--
|
||||
2.5.5
|
||||
2.17.2
|
||||
|
||||
|
||||
23
file.spec
23
file.spec
@ -14,8 +14,8 @@
|
||||
|
||||
Summary: A utility for determining file types
|
||||
Name: file
|
||||
Version: 5.35
|
||||
Release: 5%{?dist}
|
||||
Version: 5.36
|
||||
Release: 1%{?dist}
|
||||
License: BSD
|
||||
Source0: ftp://ftp.astron.com/pub/file/file-%{version}.tar.gz
|
||||
|
||||
@ -26,18 +26,6 @@ Patch0: file-localmagic.patch
|
||||
Patch1: file-4.17-rpm-name.patch
|
||||
Patch2: file-5.04-volume_key.patch
|
||||
|
||||
# add magic for eBPF objects (#1648667)
|
||||
Patch4: file-5.34-ebpf-magic.patch
|
||||
|
||||
# fixed bug misleading qcow2 v2 and v3 files (#1654349)
|
||||
Patch5: file-5.35-qcow2-misleading.patch
|
||||
|
||||
# fixed bug missidentifying netpbm files (#856092)
|
||||
Patch6: file-5.35-netpbm-misleading.patch
|
||||
|
||||
# added Linux PowerPC core offsets for Linux + fixed bug #1161911
|
||||
Patch7: file-5.35-add-PowerPC-core-offsets.patch
|
||||
|
||||
URL: http://www.darwinsys.com/file/
|
||||
Requires: file-libs = %{version}-%{release}
|
||||
BuildRequires: zlib-devel
|
||||
@ -214,6 +202,13 @@ cd %{py3dir}
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Feb 21 2019 Siteshwar Vashisht <svashisht@redhat.com> - 5.36-1
|
||||
- update to new version 5.36, which fixes the following vulnerabilities:
|
||||
CVE-2019-8907 - remote denial of service in do_core_note in readelf.c
|
||||
CVE-2019-8905 - stack-based buffer over-read in do_core_note in readelf.c
|
||||
CVE-2019-8904 - stack-based buffer over-read in do_bid_note in readelf.c
|
||||
CVE-2019-8906 - out-of-bounds read in do_core_note in readelf.c
|
||||
|
||||
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5.35-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (file-5.35.tar.gz) = cbecc52e9209be8bc090752d0672efa181625d4e1e688e63edd1f5657b29bad69364a477fb4ed85d1fa413b8002c8578c86153d2acaaecce78446c0ca6ea9e38
|
||||
SHA512 (file-5.36.tar.gz) = 3ec5e51ffb7a82defa74845a90fbc983f6e169fc116606049bc01ff6e720d340c8abf6eb7a08b9ac1099162a5c02deac3633b07b039d486344c8abd9052ca751
|
||||
|
||||
Loading…
Reference in New Issue
Block a user