diff options
| author | Andre McCurdy <armccurdy@gmail.com> | 2018-05-24 17:14:19 -0700 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2018-06-15 17:56:24 +0100 |
| commit | 31a87d4d1dc80c6054c15a6f7dbc83b4d79bf0b2 (patch) | |
| tree | 750028c0d52529c6775317f8a4dbbebec338f9db /meta/classes/copyleft_compliance.bbclass | |
| parent | a0a395a8c614277cdbfe3f13ae7f200c85d1f2b5 (diff) | |
| download | poky-31a87d4d1dc80c6054c15a6f7dbc83b4d79bf0b2.tar.gz | |
cpio: fix CVE-2016-2037
"The cpio_safer_name_suffix function in util.c in cpio 2.11 allows
remote attackers to cause a denial of service (out-of-bounds write)
via a crafted cpio file."
https://nvd.nist.gov/vuln/detail/CVE-2016-2037
Note that there appear to be two versions of this fix. The original
patch posted to the bug-cpio mailing list [1] is used by Debian [2],
but apparently causes regression [3]. The patch accepted to the
upstream git repo [4] seems to be the most complete fix.
[1] https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html
[2] https://security-tracker.debian.org/tracker/CVE-2016-2037
[3] https://www.mail-archive.com/bug-cpio@gnu.org/msg00584.html
[4] http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=d36ec5f4e93130efb24fb9678aafd88e8070095b
(From OE-Core rev: f170288ac706126e69a504a14d564b2e5c3513e4)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/classes/copyleft_compliance.bbclass')
0 files changed, 0 insertions, 0 deletions