Skip to content

Nopatch unzip CVE-2008-0888 #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmcilvaney merged 1 commit into from
Sep 29, 2020
Merged

Nopatch unzip CVE-2008-0888 #154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions SPECS/unzip/CVE-2008-0888.nopatch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
# Upstream has fixed CVE-2008-0888 in 6.0
6 changes: 5 additions & 1 deletion SPECS/unzip/unzip.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: Unzip-6.0
Name: unzip
Version: 6.0
Release: 15%{?dist}
Release: 16%{?dist}
License: BSD
URL: http://infozip.sourceforge.net/UnZip.html
Source0: https://downloads.sourceforge.net/infozip/unzip60.tar.gz
Expand All @@ -27,6 +27,8 @@ Patch12: unzip-zipbomb-manpage.patch
Patch13: CVE-2015-7697.patch
# Fixes CVE-2018-1000035
Patch14: unzip-6.0-cve-2018-1000035-heap-based-overflow.patch
# Upstream has fixed CVE-2008-0888 in 6.0
Patch15: CVE-2008-0888.nopatch

%description
The UnZip package contains ZIP extraction utilities. These are useful
Expand Down Expand Up @@ -84,6 +86,8 @@ make %{?_smp_mflags} check
%{_bindir}/*

%changelog
* Mon Sep 28 2020 Daniel McIlvaney <damcilva@microsoft.com> 6.0-16
- Nopatch CVE-2008-0888, fixed in 6.0
* Thu Jul 09 2020 Daniel McIlvaney <damcilva@microsoft.com> 6.0-15
- Add patch for CVE-2018-1000035 from Fedora 6.0-47 package
* Thu May 13 2020 Henry Beberman <henry.beberman@microsoft.com> - 6.0-14
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,8 +369,8 @@ tdnf-plugin-repogpgcheck-2.1.0-4.cm1.aarch64.rpm
tdnf-python-2.1.0-4.cm1.aarch64.rpm
texinfo-6.5-7.cm1.aarch64.rpm
texinfo-debuginfo-6.5-7.cm1.aarch64.rpm
unzip-6.0-15.cm1.aarch64.rpm
unzip-debuginfo-6.0-15.cm1.aarch64.rpm
unzip-6.0-16.cm1.aarch64.rpm
unzip-debuginfo-6.0-16.cm1.aarch64.rpm
util-linux-2.32.1-3.cm1.aarch64.rpm
util-linux-debuginfo-2.32.1-3.cm1.aarch64.rpm
util-linux-devel-2.32.1-3.cm1.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,8 +369,8 @@ tdnf-plugin-repogpgcheck-2.1.0-4.cm1.x86_64.rpm
tdnf-python-2.1.0-4.cm1.x86_64.rpm
texinfo-6.5-7.cm1.x86_64.rpm
texinfo-debuginfo-6.5-7.cm1.x86_64.rpm
unzip-6.0-15.cm1.x86_64.rpm
unzip-debuginfo-6.0-15.cm1.x86_64.rpm
unzip-6.0-16.cm1.x86_64.rpm
unzip-debuginfo-6.0-16.cm1.x86_64.rpm
util-linux-2.32.1-3.cm1.x86_64.rpm
util-linux-debuginfo-2.32.1-3.cm1.x86_64.rpm
util-linux-devel-2.32.1-3.cm1.x86_64.rpm
Expand Down