Re: [Buildroot] [PATCH 1/2] package/gzip: security bump to 1.12

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Marcus" == Marcus Hoffmann <marcus.hoffmann@othermo.de> writes:

 > Fixes the following security issues:
 > CVE-2022-1271: arbitrary-file-write vulnerability

 > zgrep applied to a crafted file name with two or more newlines
 > can no longer overwrite an arbitrary, attacker-selected file.
 > [bug introduced in gzip-1.3.10]

 > https://www.openwall.com/lists/oss-security/2022/04/07/8

 > Other changes:

 > ** Changes in behavior

 >   'gzip -l' no longer misreports file lengths 4 GiB and larger.
 >   Previously, 'gzip -l' output the 32-bit value stored in the gzip
 >   header even though that is the uncompressed length modulo 2**32.
 >   Now, 'gzip -l' calculates the uncompressed length by decompressing
 >   the data and counting the resulting bytes.  Although this can take
 >   much more time, nowadays the correctness pros seem to outweigh the
 >   performance cons.

 >   'zless' is no longer installed on platforms lacking 'less'.

 > ** Bug fixes

 >   zgrep now names input file on error instead of mislabeling it as
 >   "(standard input)", if grep supports the GNU -H and --label options.

 >   'zdiff -C 5' no longer misbehaves by treating '5' as a file name.
 >   [bug present since the beginning]

 >   Configure-time options like --program-prefix now work.

 > Release Announcement:
 > https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html

 > Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>

Committed to 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot