From cbf796a8266598c27a3af77fcef577ba5e10297f Mon Sep 17 00:00:00 2001 From: Zhixiong Chi Date: Thu, 28 Sep 2017 16:06:05 +0800 Subject: libarchive: CVE-2017-14502 read_header in archive_read_support_format_rar.c suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header. Backport the patch from https://github.com/libarchive/libarchive/commit commit 5562545b5562f6d12a4ef991fae158bf4ccf92b6 CVE: CVE-2017-14502 (From OE-Core rev: 0bedb69abff85cc07ad4a54eed41d15d0a38c080) Signed-off-by: Zhixiong Chi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- meta/recipes-extended/libarchive/libarchive_3.3.2.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-extended/libarchive/libarchive_3.3.2.bb') diff --git a/meta/recipes-extended/libarchive/libarchive_3.3.2.bb b/meta/recipes-extended/libarchive/libarchive_3.3.2.bb index 9e4588fe77..edc4d6a152 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.3.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.3.2.bb @@ -34,6 +34,7 @@ EXTRA_OECONF += "--enable-largefile" SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://bug929.patch \ file://CVE-2017-14166.patch \ + file://CVE-2017-14502.patch \ " SRC_URI[md5sum] = "4583bd6b2ebf7e0e8963d90879eb1b27" -- cgit v1.2.3-54-g00ecf