From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 0/1] libarchive: Fix CVE-2016-1541 Date: Tue, 10 May 2016 16:29:08 -0400 Message-ID: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:46514) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b0EHa-0006Ag-OM for guix-devel@gnu.org; Tue, 10 May 2016 16:29:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1b0EHU-0007VP-5o for guix-devel@gnu.org; Tue, 10 May 2016 16:29:29 -0400 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:60631) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1b0EHR-0007Sm-J3 for guix-devel@gnu.org; Tue, 10 May 2016 16:29:24 -0400 Received: from jasmine.lan (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id AABEBC00012 for ; Tue, 10 May 2016 16:29:12 -0400 (EDT) List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org There is a buffer overflow in libarchive, CVE-2016-1541 [0]. According to MITRE description, it "allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive." Yikes! This patch applies the upstream patch [1]. Requesting your review, since soooo many packages depend on libarchive. I will follow this commit with an "ungrafting" commit on core-updates. [0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1541 [1] https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7 Leo Famulari (1): gnu: libarchive: Fix CVE-2016-1541. gnu/local.mk | 1 + gnu/packages/backup.scm | 9 +++ .../patches/libarchive-CVE-2016-1541.patch | 67 ++++++++++++++++++++++ 3 files changed, 77 insertions(+) create mode 100644 gnu/packages/patches/libarchive-CVE-2016-1541.patch -- 2.8.2