From aee1b2acfb229482b3c93ae75249d9addb1fc68c Mon Sep 17 00:00:00 2001 From: Li Zhou Date: Fri, 24 Apr 2015 15:36:36 +0800 Subject: libarchive: Security Advisory - libarchive - CVE-2015-2304 libarchive: Updated libarchive packages fix security vulnerability Alexander Cherepanov discovered that bsdcpio, an implementation of the "cpio" program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths. (From OE-Core rev: e64a961e9c5e94e643896e4b68b85bd5b4c27470) Signed-off-by: Li Zhou Signed-off-by: Richard Purdie --- meta/recipes-extended/libarchive/libarchive_3.1.2.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-extended/libarchive/libarchive_3.1.2.bb') diff --git a/meta/recipes-extended/libarchive/libarchive_3.1.2.bb b/meta/recipes-extended/libarchive/libarchive_3.1.2.bb index 96e2d500ed..75008c3e26 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.1.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.1.2.bb @@ -32,6 +32,7 @@ PACKAGECONFIG[nettle] = "--with-nettle,--without-nettle,nettle," SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://libarchive-CVE-2013-0211.patch \ file://pkgconfig.patch \ + file://0001-Add-ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS-option.patch \ " SRC_URI[md5sum] = "efad5a503f66329bb9d2f4308b5de98a" -- cgit v1.2.3-54-g00ecf