diff --git a/oniguruma-15c4228-bz1755880_2.patch b/oniguruma-15c4228-bz1755880_2.patch new file mode 100644 index 0000000..88c58a5 --- /dev/null +++ b/oniguruma-15c4228-bz1755880_2.patch @@ -0,0 +1,32 @@ +commit 15c4228aa2ffa02140a99912dd3177df0b1841c6 +Author: K.Kosako +Date: Fri Oct 4 19:54:40 2019 +0900 + + fix #156: Heap buffer overflow in match_at() with case-insensitive match + +diff --git a/src/regcomp.c b/src/regcomp.c +index cd379a2..52f6f01 100644 +--- a/src/regcomp.c ++++ b/src/regcomp.c +@@ -734,8 +734,8 @@ add_compile_string(UChar* s, int mb_len, int str_len, + COP(reg)->exact_n.s = p; + } + else { ++ xmemset(COP(reg)->exact.s, 0, sizeof(COP(reg)->exact.s)); + xmemcpy(COP(reg)->exact.s, s, (size_t )byte_len); +- COP(reg)->exact.s[byte_len] = '\0'; + } + + return 0; +diff --git a/src/regexec.c b/src/regexec.c +index e471491..4bcd8a9 100644 +--- a/src/regexec.c ++++ b/src/regexec.c +@@ -2889,6 +2889,7 @@ match_at(regex_t* reg, const UChar* str, const UChar* end, + DATA_ENSURE(0); + q = lowbuf; + while (len-- > 0) { ++ if (ps >= endp) goto fail; + if (*ps != *q) goto fail; + ps++; q++; + } diff --git a/oniguruma-CVE-2019-16163.patch b/oniguruma-CVE-2019-16163.patch new file mode 100644 index 0000000..16108b4 --- /dev/null +++ b/oniguruma-CVE-2019-16163.patch @@ -0,0 +1,49 @@ +commit 4097828d7cc87589864fecf452f2cd46c5f37180 +Author: K.Kosako +Date: Mon Jul 29 12:52:56 2019 +0900 + + fix #147: Stack Exhaustion Problem caused by some parsing functions in regcomp.c making recursive calls to themselves. + +diff --git a/src/regparse.c b/src/regparse.c +index 123d6cb..1a1ef6b 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -6239,6 +6239,7 @@ parse_char_class(Node** np, PToken* tok, UChar** src, UChar* end, ScanEnv* env) + env->parse_depth++; + if (env->parse_depth > ParseDepthLimit) + return ONIGERR_PARSE_DEPTH_LIMIT_OVER; ++ + prev_cc = (CClassNode* )NULL; + r = fetch_token_in_cc(tok, src, end, env); + if (r == TK_CHAR && tok->u.c == '^' && tok->escaped == 0) { +@@ -7820,14 +7821,18 @@ static int + parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end, + ScanEnv* env, int group_head) + { +- int r, len, group = 0; ++ int r, len, group; + Node* qn; + Node** tp; ++ unsigned int parse_depth; + ++ group = 0; + *np = NULL; + if (tok->type == (enum TokenSyms )term) + goto end_of_token; + ++ parse_depth = env->parse_depth; ++ + switch (tok->type) { + case TK_ALT: + case TK_EOT: +@@ -8145,6 +8150,10 @@ parse_exp(Node** np, PToken* tok, int term, UChar** src, UChar* end, + if (is_invalid_quantifier_target(*tp)) + return ONIGERR_TARGET_OF_REPEAT_OPERATOR_INVALID; + ++ parse_depth++; ++ if (parse_depth > ParseDepthLimit) ++ return ONIGERR_PARSE_DEPTH_LIMIT_OVER; ++ + qn = node_new_quantifier(tok->u.repeat.lower, tok->u.repeat.upper, + r == TK_INTERVAL); + CHECK_NULL_RETURN_MEMERR(qn); diff --git a/oniguruma-CVE-2019-19012-2-backport.patch b/oniguruma-CVE-2019-19012-2-backport.patch new file mode 100644 index 0000000..6b2c939 --- /dev/null +++ b/oniguruma-CVE-2019-19012-2-backport.patch @@ -0,0 +1,52 @@ +--- onig-6.9.2/src/regexec.c.CVE-2019-19012-2 2019-11-29 01:43:09.491168972 +0900 ++++ onig-6.9.2/src/regexec.c 2019-11-29 11:21:30.886372465 +0900 +@@ -4471,14 +4471,14 @@ + #endif + + p = s; +- if (reg->dmin > 0) { ++ if (reg->dmin != 0) { ++ if (end - p <= reg->dmin) ++ return 0; /* fail */ + if (ONIGENC_IS_SINGLEBYTE(reg->enc)) { + p += reg->dmin; + } + else { + UChar *q = p + reg->dmin; +- +- if (q >= end) return 0; /* fail */ + while (p < q) p += enclen(reg->enc, p); + } + } +@@ -4513,7 +4513,7 @@ + } + + if (p && p < range) { +- if (p - reg->dmin < s) { ++ if (p - s < reg->dmin) { + retry_gate: + pprev = p; + p += enclen(reg->enc, p); +@@ -4561,6 +4561,7 @@ + *low_prev = onigenc_get_prev_char_head(reg->enc, + (pprev ? pprev : str), p); + } ++ *high = p; + } + else { + if (reg->dmax != INFINITE_LEN) { +@@ -4585,9 +4586,12 @@ + } + } + } ++ /* no needs to adjust *high, *high is used as range check only */ ++ if (p - str < reg->dmin) ++ *high = (UChar* )str; ++ else ++ *high = p - reg->dmin; + } +- /* no needs to adjust *high, *high is used as range check only */ +- *high = p - reg->dmin; + + #ifdef ONIG_DEBUG_SEARCH + fprintf(stderr, diff --git a/oniguruma-CVE-2019-19012-3-backport.patch b/oniguruma-CVE-2019-19012-3-backport.patch new file mode 100644 index 0000000..c88e759 --- /dev/null +++ b/oniguruma-CVE-2019-19012-3-backport.patch @@ -0,0 +1,71 @@ +--- onig-6.9.2/src/regexec.c.CVE-2019-19012-3 2019-11-29 11:26:09.207220372 +0900 ++++ onig-6.9.2/src/regexec.c 2019-11-29 11:43:32.583653353 +0900 +@@ -4612,9 +4612,6 @@ backward_search_range(regex_t* reg, cons + { + UChar *p; + +- if (range == 0) goto fail; +- +- range += reg->dmin; + p = s; + + retry: +@@ -4683,8 +4680,21 @@ backward_search_range(regex_t* reg, cons + + /* no needs to adjust *high, *high is used as range check only */ + if (reg->dmax != INFINITE_LEN) { +- *low = p - reg->dmax; +- *high = p - reg->dmin; ++ if (p - str < reg->dmax) ++ *low = (UChar* )str; ++ else ++ *low = p - reg->dmax; ++ ++ if (reg->dmin != 0) { ++ if (p - str < reg->dmin) ++ *high = (UChar* )str; ++ else ++ *high = p - reg->dmin; ++ } ++ else { ++ *high = p; ++ } ++ + *high = onigenc_get_right_adjust_char_head(reg->enc, adjrange, *high); + } + +@@ -4972,18 +4982,24 @@ onig_search_with_param(regex_t* reg, con + + if (reg->optimize != OPTIMIZE_NONE) { + UChar *low, *high, *adjrange, *sch_start; ++ const UChar *min_range; + + if (range < end) + adjrange = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, range); + else + adjrange = (UChar* )end; + ++ if (end - range > reg->dmin) ++ min_range = range + reg->dmin; ++ else ++ min_range = end; ++ + if (reg->dmax != INFINITE_LEN && + (end - range) >= reg->threshold_len) { + do { + sch_start = s + reg->dmax; + if (sch_start > end) sch_start = (UChar* )end; +- if (backward_search_range(reg, str, end, sch_start, range, adjrange, ++ if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, + &low, &high) <= 0) + goto mismatch; + +@@ -5013,7 +5029,7 @@ onig_search_with_param(regex_t* reg, con + start, sch_start); + } + } +- if (backward_search_range(reg, str, end, sch_start, range, adjrange, ++ if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, + &low, &high) <= 0) goto mismatch; + } + } diff --git a/oniguruma-CVE-2019-19012-4-backport.patch b/oniguruma-CVE-2019-19012-4-backport.patch new file mode 100644 index 0000000..574aa81 --- /dev/null +++ b/oniguruma-CVE-2019-19012-4-backport.patch @@ -0,0 +1,57 @@ +--- onig-6.9.2/src/regexec.c.CVE-2019-19012-4 2019-11-29 12:00:47.015072189 +0900 ++++ onig-6.9.2/src/regexec.c 2019-11-29 12:32:23.232860721 +0900 +@@ -4911,15 +4911,19 @@ onig_search_with_param(regex_t* reg, con + if (reg->optimize != OPTIMIZE_NONE) { + UChar *sch_range, *low, *high, *low_prev; + +- sch_range = (UChar* )range; + if (reg->dmax != 0) { + if (reg->dmax == INFINITE_LEN) + sch_range = (UChar* )end; + else { +- sch_range += reg->dmax; +- if (sch_range > end) sch_range = (UChar* )end; ++ if (end - range < reg->dmax) ++ sch_range = (UChar* )end; ++ else { ++ sch_range = (UChar* )range + reg->dmax; ++ } + } + } ++ else ++ sch_range = (UChar* )range; + + if ((end - start) < reg->threshold_len) + goto mismatch; +@@ -4995,8 +4999,12 @@ onig_search_with_param(regex_t* reg, con + if (reg->dmax != INFINITE_LEN && + (end - range) >= reg->threshold_len) { + do { +- sch_start = s + reg->dmax; +- if (sch_start > end) sch_start = (UChar* )end; ++ if (end - s > reg->dmax) ++ sch_start = s + reg->dmax; ++ else { ++ sch_start = (UChar* )end; ++ } ++ + if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, + &low, &high) <= 0) + goto mismatch; +@@ -5020,11 +5028,13 @@ onig_search_with_param(regex_t* reg, con + if (reg->dmax == INFINITE_LEN) + sch_start = (UChar* )end; + else { +- sch_start += reg->dmax; +- if (sch_start > end) sch_start = (UChar* )end; +- else ++ if (end - s < reg->dmax) ++ sch_start = (UChar* )end; ++ else { ++ sch_start += reg->dmax; + sch_start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, + start, sch_start); ++ } + } + } + if (backward_search_range(reg, str, end, sch_start, min_range, adjrange, diff --git a/oniguruma-CVE-2019-19012-5-backport.patch b/oniguruma-CVE-2019-19012-5-backport.patch new file mode 100644 index 0000000..2999784 --- /dev/null +++ b/oniguruma-CVE-2019-19012-5-backport.patch @@ -0,0 +1,43 @@ +--- onig-6.9.2/src/regexec.c.CVE-2019-19012-5 2019-11-29 12:32:23.232860721 +0900 ++++ onig-6.9.2/src/regexec.c 2019-11-29 13:32:24.401699168 +0900 +@@ -4824,13 +4824,16 @@ onig_search_with_param(regex_t* reg, con + goto mismatch_no_msa; + + if (range > start) { +- if ((OnigLen )(min_semi_end - start) > reg->anchor_dmax) { ++ if (min_semi_end - start > reg->anchor_dmax) { + start = min_semi_end - reg->anchor_dmax; + if (start < end) + start = onigenc_get_right_adjust_char_head(reg->enc, str, start); + } +- if ((OnigLen )(max_semi_end - (range - 1)) < reg->anchor_dmin) { +- range = max_semi_end - reg->anchor_dmin + 1; ++ if (max_semi_end - (range - 1) < reg->anchor_dmin) { ++ if (max_semi_end - str + 1 < reg->anchor_dmin) ++ goto mismatch_no_msa; ++ else ++ range = max_semi_end - reg->anchor_dmin + 1; + } + + if (start > range) goto mismatch_no_msa; +@@ -4838,12 +4841,16 @@ onig_search_with_param(regex_t* reg, con + Backward search is used. */ + } + else { +- if ((OnigLen )(min_semi_end - range) > reg->anchor_dmax) { ++ if (min_semi_end - range > reg->anchor_dmax) { + range = min_semi_end - reg->anchor_dmax; + } +- if ((OnigLen )(max_semi_end - start) < reg->anchor_dmin) { +- start = max_semi_end - reg->anchor_dmin; +- start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start); ++ if (max_semi_end - start < reg->anchor_dmin) { ++ if (max_semi_end - str < reg->anchor_dmin) ++ goto mismatch_no_msa; ++ else { ++ start = max_semi_end - reg->anchor_dmin; ++ start = ONIGENC_LEFT_ADJUST_CHAR_HEAD(reg->enc, str, start); ++ } + } + if (range > start) goto mismatch_no_msa; + } diff --git a/oniguruma-CVE-2019-19203.patch b/oniguruma-CVE-2019-19203.patch new file mode 100644 index 0000000..610c8c1 --- /dev/null +++ b/oniguruma-CVE-2019-19203.patch @@ -0,0 +1,126 @@ +From aa0188eaedc056dca8374ac03d0177429b495515 Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Thu, 7 Nov 2019 14:13:55 +0900 +Subject: [PATCH] fix #163: heap-buffer-overflow in gb18030_mbc_enc_len + +--- + src/gb18030.c | 16 +++++++++++++++- + src/regparse.c | 32 ++++++++++++++++++++++---------- + 2 files changed, 37 insertions(+), 11 deletions(-) + +diff --git a/src/gb18030.c b/src/gb18030.c +index ad5bf96..da6cfab 100644 +--- a/src/gb18030.c ++++ b/src/gb18030.c +@@ -75,6 +75,20 @@ gb18030_mbc_enc_len(const UChar* p) + return 2; + } + ++static int ++gb18030_code_to_mbclen(OnigCodePoint code) ++{ ++ if ((code & 0xff000000) != 0) return 4; ++ else if ((code & 0xff0000) != 0) return ONIGERR_INVALID_CODE_POINT_VALUE; ++ else if ((code & 0xff00) != 0) return 2; ++ else { ++ if (GB18030_MAP[(int )(code & 0xff)] == CM) ++ return ONIGERR_INVALID_CODE_POINT_VALUE; ++ ++ return 1; ++ } ++} ++ + static int + is_valid_mbc_string(const UChar* p, const UChar* end) + { +@@ -513,7 +527,7 @@ OnigEncodingType OnigEncodingGB18030 = { + 1, /* min enc length */ + onigenc_is_mbc_newline_0x0a, + gb18030_mbc_to_code, +- onigenc_mb4_code_to_mbclen, ++ gb18030_code_to_mbclen, + gb18030_code_to_mbc, + gb18030_mbc_case_fold, + onigenc_ascii_apply_all_case_fold, +diff --git a/src/regparse.c b/src/regparse.c +index 70c36d5..5bf25e8 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -5885,6 +5885,7 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env) + + int c, r; + int ascii_mode; ++ int is_single; + const OnigCodePoint *ranges; + OnigCodePoint limit; + OnigCodePoint sb_out; +@@ -5906,6 +5907,7 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env) + } + + r = 0; ++ is_single = ONIGENC_IS_SINGLEBYTE(enc); + limit = ascii_mode ? ASCII_LIMIT : SINGLE_BYTE_SIZE; + + switch (ctype) { +@@ -5922,19 +5924,25 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env) + case ONIGENC_CTYPE_ALNUM: + if (not != 0) { + for (c = 0; c < (int )limit; c++) { +- if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) +- BITSET_SET_BIT(cc->bs, c); ++ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) { ++ if (! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) ++ BITSET_SET_BIT(cc->bs, c); ++ } + } + for (c = limit; c < SINGLE_BYTE_SIZE; c++) { +- BITSET_SET_BIT(cc->bs, c); ++ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) ++ BITSET_SET_BIT(cc->bs, c); + } + +- ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf); ++ if (is_single == 0) ++ ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf); + } + else { + for (c = 0; c < (int )limit; c++) { +- if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) +- BITSET_SET_BIT(cc->bs, c); ++ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) { ++ if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) ++ BITSET_SET_BIT(cc->bs, c); ++ } + } + } + break; +@@ -5944,21 +5952,25 @@ add_ctype_to_cc(CClassNode* cc, int ctype, int not, ScanEnv* env) + case ONIGENC_CTYPE_WORD: + if (not != 0) { + for (c = 0; c < (int )limit; c++) { +- if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0 /* check invalid code point */ ++ /* check invalid code point */ ++ if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) + && ! ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) + BITSET_SET_BIT(cc->bs, c); + } + for (c = limit; c < SINGLE_BYTE_SIZE; c++) { +- if (ONIGENC_CODE_TO_MBCLEN(enc, c) > 0) ++ if (is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) + BITSET_SET_BIT(cc->bs, c); + } ++ if (ascii_mode != 0 && is_single == 0) ++ ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf); + } + else { + for (c = 0; c < (int )limit; c++) { +- if (ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) ++ if ((is_single != 0 || ONIGENC_CODE_TO_MBCLEN(enc, c) == 1) ++ && ONIGENC_IS_CODE_CTYPE(enc, (OnigCodePoint )c, ctype)) + BITSET_SET_BIT(cc->bs, c); + } +- if (ascii_mode == 0) ++ if (ascii_mode == 0 && is_single == 0) + ADD_ALL_MULTI_BYTE_RANGE(enc, cc->mbuf); + } + break; diff --git a/oniguruma-CVE-2019-19204.patch b/oniguruma-CVE-2019-19204.patch new file mode 100644 index 0000000..23d70bb --- /dev/null +++ b/oniguruma-CVE-2019-19204.patch @@ -0,0 +1,23 @@ +From 6eb4aca6a7f2f60f473580576d86686ed6a6ebec Mon Sep 17 00:00:00 2001 +From: "K.Kosako" +Date: Wed, 6 Nov 2019 17:32:29 +0900 +Subject: [PATCH] fix #162: heap-buffer-overflow in fetch_interval_quantifier + due to double PFETCH + +--- + src/regparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/regparse.c b/src/regparse.c +index 324c414..70c36d5 100644 +--- a/src/regparse.c ++++ b/src/regparse.c +@@ -4178,7 +4178,7 @@ fetch_interval_quantifier(UChar** src, UChar* end, PToken* tok, ScanEnv* env) + if (PEND) goto invalid; + PFETCH(c); + if (IS_SYNTAX_OP(env->syntax, ONIG_SYN_OP_ESC_BRACE_INTERVAL)) { +- if (c != MC_ESC(env->syntax)) goto invalid; ++ if (c != MC_ESC(env->syntax) || PEND) goto invalid; + PFETCH(c); + } + if (c != '}') goto invalid; diff --git a/oniguruma-d3e4029-bz1755880.patch b/oniguruma-d3e4029-bz1755880.patch new file mode 100644 index 0000000..a9d618d --- /dev/null +++ b/oniguruma-d3e4029-bz1755880.patch @@ -0,0 +1,18 @@ +commit d3e402928b6eb3327f8f7d59a9edfa622fec557b +Author: K.Kosako +Date: Tue Aug 13 13:37:30 2019 +0900 + + fix heap-buffer-overflow + +diff --git a/src/regexec.c b/src/regexec.c +index 0753b07..634ee42 100644 +--- a/src/regexec.c ++++ b/src/regexec.c +@@ -4196,6 +4196,7 @@ str_lower_case_match(OnigEncoding enc, int case_fold_flag, + lowlen = ONIGENC_MBC_CASE_FOLD(enc, case_fold_flag, &p, end, lowbuf); + q = lowbuf; + while (lowlen > 0) { ++ if (t >= tend) return 0; + if (*t++ != *q++) return 0; + lowlen--; + } diff --git a/oniguruma.spec b/oniguruma.spec index 7bc0bb1..26f2b06 100644 --- a/oniguruma.spec +++ b/oniguruma.spec @@ -3,7 +3,7 @@ %global mainver 6.9.2 #%%global betaver rc3 -%global fedorarel 2 +%global fedorarel 4 Name: oniguruma Version: %{mainver} @@ -14,7 +14,30 @@ License: BSD URL: https://github.com/kkos/oniguruma/ Source0: https://github.com/kkos/oniguruma/releases/download/v%{mainver}%{?betaver:_%betaver}/onig-%{mainver}%{?betaver:-%betaver}.tar.gz # upstream patches +# #1728966 CVE-2019-13225 Patch10: 0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch +# #1768997 CVE-2019-16163 +Patch12: oniguruma-CVE-2019-16163.patch +# #1755880 d3e402928b6eb3327f8f7d59a9edfa622fec557b +# #1777537 This one is assigned as CVE-2019-19246 +Patch13: oniguruma-d3e4029-bz1755880.patch +# #1755880 15c4228aa2ffa02140a99912dd3177df0b1841c6 +Patch14: oniguruma-15c4228-bz1755880_2.patch +# https://github.com/kkos/oniguruma/issues/162 +Patch15: oniguruma-CVE-2019-19204.patch +# https://github.com/kkos/oniguruma/issues/163 +Patch16: oniguruma-CVE-2019-19203.patch +# https://github.com/kkos/oniguruma/issues/164 +# Modified, the upstream commit does not apply cleanly +# because variable name, etc changed. +# Patch21: oniguruma-CVE-2019-19012-1.patch +# Patch21: not needed, no correspoinding code in 6.9.2, +# note that the similar lines appears in Patch24 +Patch22: oniguruma-CVE-2019-19012-2-backport.patch +Patch23: oniguruma-CVE-2019-19012-3-backport.patch +Patch24: oniguruma-CVE-2019-19012-4-backport.patch +Patch25: oniguruma-CVE-2019-19012-5-backport.patch +# #1728971 CVE-2019-13224 #Patch11: 0011-Fix-CVE-2019-13224-don-t-allow-different-encodings-f.patch # Not use Patch11 for F-30 and below, this is almost API change (deprecation of API) in # onig_new_deluxe() and this change should be avoided (if possible) in stable @@ -22,6 +45,10 @@ Patch10: 0010-Fix-CVE-2019-13225-problem-in-converting-if-then-els.patch # Instead use another fix Patch101: 0101-onig_new_deluxe-don-t-free-new-pattern-if-success.patch +# Just note +# #1769042 CVE-2019-16161 - This is for onigumo, and oniguruma is not affected +# (I guess - mtasaka) + BuildRequires: gcc %description @@ -60,6 +87,16 @@ done %patch10 -p1 -b .CVE-2019-13225 #%%patch11 -p1 -b .CVE-2019-13224 %patch101 -p1 -b .CVE-2019-13224 +%patch12 -p1 -b .CVE-2019-16163 +%patch13 -p1 -b .bz1755880_1.CVE-2019-19246 +%patch14 -p1 -b .bz1755880_2 +%patch15 -p1 -b .CVE-2019-19204 +%patch16 -p1 -b .CVE-2019-19203 +#%patch21 -p1 -b .CVE-2019-19012-1 # Not needed +%patch22 -p1 -b .CVE-2019-19012-2 +%patch23 -p1 -b .CVE-2019-19012-3 +%patch24 -p1 -b .CVE-2019-19012-4 +%patch25 -p1 -b .CVE-2019-19012-5 %build %configure \ @@ -116,6 +153,14 @@ find $RPM_BUILD_ROOT -name '*.la' \ %{_libdir}/pkgconfig/%{name}.pc %changelog +* Fri Nov 29 2019 Mamoru TASAKA - 6.9.2-4 +- Address CVE-2019-19204 CVE-2019-19203 CVE-2019-19012 + +* Mon Nov 11 2019 Mamoru TASAKA - 6.9.2-3 +- Upstream patch for CVE-2019-16163 (#1768997) +- Another fix backports out of request from PHP maintainer (#1728971) + (One of them is now assigned as CVE-2019-19246) + * Fri Jul 12 2019 Mamoru TASAKA - 6.9.2-2 - Upstream patch for CVE-2019-13225 (#1728966) - NON-upstream patch for CVE-2019-13224 (#1728971)