rpms/ncurses
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS ncurses-6.1-10.20180224.el8

Browse Source
This commit is contained in:
eabdullin 2023-09-27 13:43:42 +00:00
parent fc7dbe6f61
commit 959e2cfd7b
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
SOURCES/ncurses-cve-2023-29491.patch Normal file
View File

@ -0,0 +1,13 @@
diff -up ncurses-6.2-20210508/ncurses/tinfo/read_entry.c.cve-2023-29491 ncurses-6.2-20210508/ncurses/tinfo/read_entry.c
--- ncurses-6.2-20210508/ncurses/tinfo/read_entry.c.cve-2023-29491 2023-08-14 15:52:46.536461992 +0200
+++ ncurses-6.2-20210508/ncurses/tinfo/read_entry.c 2023-08-14 15:55:04.384426095 +0200
@@ -308,6 +308,9 @@ _nc_read_termtype(TERMTYPE2 *ptr, char *
|| bool_count < 0
|| num_count < 0
|| str_count < 0
+ || bool_count > BOOLCOUNT
+ || num_count > NUMCOUNT
+ || str_count > STRCOUNT
|| str_size < 0) {
returnDB(TGETENT_NO);
}

7
SPECS/ncurses.spec
View File

@ -2,7 +2,7 @@
Summary: Ncurses support utilities
Name: ncurses
Version: 6.1
Release: 9.%{revision}%{?dist}
Release: 10.%{revision}%{?dist}
License: MIT
Group: System Environment/Base
URL: https://invisible-island.net/ncurses/ncurses.html
@ -16,6 +16,7 @@ Patch12: ncurses-kbs.patch
Patch13: ncurses-cve-2019-17594.patch
Patch14: ncurses-cve-2019-17595.patch
Patch15: ncurses-tputx.patch
Patch16: ncurses-cve-2023-29491.patch
BuildRequires: gcc gcc-c++ gpm-devel pkgconfig
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
@ -133,6 +134,7 @@ The ncurses-static package includes static libraries of the ncurses library.
%patch13 -p1 -b .cve-2019-17594
%patch14 -p1 -b .cve-2019-17595
%patch15 -p1 -b .tputx
%patch16 -p1 -b .cve-2023-29491
for f in ANNOUNCE; do
iconv -f iso8859-1 -t utf8 -o ${f}{_,} &&
@ -299,6 +301,9 @@ bzip2 NEWS
%{_libdir}/lib*.a
%changelog
* Tue Aug 15 2023 Miroslav Lichvar <mlichvar@redhat.com> 6.1-10.20180224
- fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
* Tue May 18 2021 Miroslav Lichvar <mlichvar@redhat.com> 6.1-9.20180224
- fix tput to accept -x option (#1916340)