pyrox.dev
unzip: patch for CVE-2014-9913 and CVE-2016-9844
+29
pkgs/tools/archivers/unzip/CVE-2014-9913.patch
+29
pkgs/tools/archivers/unzip/CVE-2014-9913.patch
···
1
+
From: "Steven M. Schweda" <sms@antinode.info>
2
+
Subject: Fix CVE-2014-9913, buffer overflow in unzip
3
+
Bug: https://sourceforge.net/p/infozip/bugs/27/
4
+
Bug-Debian: https://bugs.debian.org/847485
5
+
Bug-Ubuntu: https://launchpad.net/bugs/387350
6
+
X-Debian-version: 6.0-21
7
+
8
+
--- a/list.c
9
+
+++ b/list.c
10
+
@@ -339,7 +339,18 @@
11
+
G.crec.compression_method == ENHDEFLATED) {
12
+
methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3];
13
+
} else if (methnum >= NUM_METHODS) {
14
+
- sprintf(&methbuf[4], "%03u", G.crec.compression_method);
15
+
+ /* 2013-02-26 SMS.
16
+
+ * http://sourceforge.net/p/infozip/bugs/27/ CVE-2014-9913.
17
+
+ * Unexpectedly large compression methods overflow
18
+
+ * &methbuf[]. Use the old, three-digit decimal format
19
+
+ * for values which fit. Otherwise, sacrifice the
20
+
+ * colon, and use four-digit hexadecimal.
21
+
+ */
22
+
+ if (G.crec.compression_method <= 999) {
23
+
+ sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
24
+
+ } else {
25
+
+ sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
26
+
+ }
27
+
}
28
+
29
+
#if 0 /* GRR/Euro: add this? */
+28
pkgs/tools/archivers/unzip/CVE-2016-9844.patch
+28
pkgs/tools/archivers/unzip/CVE-2016-9844.patch
···
1
+
From: "Steven M. Schweda" <sms@antinode.info>
2
+
Subject: Fix CVE-2016-9844, buffer overflow in zipinfo
3
+
Bug-Debian: https://bugs.debian.org/847486
4
+
Bug-Ubuntu: https://launchpad.net/bugs/1643750
5
+
X-Debian-version: 6.0-21
6
+
7
+
--- a/zipinfo.c
8
+
+++ b/zipinfo.c
9
+
@@ -1921,7 +1921,18 @@
10
+
ush dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3);
11
+
methbuf[3] = dtype[dnum];
12
+
} else if (methnum >= NUM_METHODS) { /* unknown */
13
+
- sprintf(&methbuf[1], "%03u", G.crec.compression_method);
14
+
+ /* 2016-12-05 SMS.
15
+
+ * https://launchpad.net/bugs/1643750
16
+
+ * Unexpectedly large compression methods overflow
17
+
+ * &methbuf[]. Use the old, three-digit decimal format
18
+
+ * for values which fit. Otherwise, sacrifice the "u",
19
+
+ * and use four-digit hexadecimal.
20
+
+ */
21
+
+ if (G.crec.compression_method <= 999) {
22
+
+ sprintf( &methbuf[ 1], "%03u", G.crec.compression_method);
23
+
+ } else {
24
+
+ sprintf( &methbuf[ 0], "%04X", G.crec.compression_method);
25
+
+ }
26
+
}
27
+
28
+
for (k = 0; k < 15; ++k)
+2
pkgs/tools/archivers/unzip/default.nix
+2
pkgs/tools/archivers/unzip/default.nix
···
18
18
./CVE-2014-9636.diff
19
19
./CVE-2015-7696.diff
20
20
./CVE-2015-7697.diff
21
+
./CVE-2014-9913.patch
22
+
./CVE-2016-9844.patch
21
23
] ++ stdenv.lib.optional enableNLS
22
24
(fetchurl {
23
25
url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-arch/unzip/files/unzip-6.0-natspec.patch?revision=1.1";