Development May 2023

development@lists.ipfire.org

9 participants
43 discussions

[PATCH] kernel: patch CVE-2023-32233
by Arne Fitzenreiter 10 May '23

10 May '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/linux | 3 + ...ter_nftables_deactivate_anonymus_set.patch | 121 ++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch diff --git a/lfs/linux b/lfs/linux index 489715424..a95c6aea4 100644 --- a/lfs/linux +++ b/lfs/linux @@ -147,6 +147,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Fix pmc compile dependency errors cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch + # Patch netfilter CVE-2023-32233 + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch + ifeq "$(BUILD_ARCH)" "aarch64" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch b/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch new file mode 100644 index 000000000..cd75de5c2 --- /dev/null +++ b/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch @@ -0,0 +1,121 @@ +From c1592a89942e9678f7d9c8030efa777c0d57edab Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso <pablo(a)netfilter.org> +Date: Tue, 2 May 2023 10:25:24 +0200 +Subject: netfilter: nf_tables: deactivate anonymous set from preparation phase + +Toggle deleted anonymous sets as inactive in the next generation, so +users cannot perform any update on it. Clear the generation bitmask +in case the transaction is aborted. + +The following KASAN splat shows a set element deletion for a bound +anonymous set that has been already removed in the same transaction. + +[ 64.921510] ================================================================== +[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables] +[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890 +[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253 +[ 64.931120] Call Trace: +[ 64.932699] <TASK> +[ 64.934292] dump_stack_lvl+0x33/0x50 +[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables] +[ 64.937551] kasan_report+0xda/0x120 +[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables] +[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables] +[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60 +[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables] +[ 64.945710] ? kasan_set_track+0x21/0x30 +[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink] +[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] + +Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> +--- + include/net/netfilter/nf_tables.h | 1 + + net/netfilter/nf_tables_api.c | 12 ++++++++++++ + net/netfilter/nft_dynset.c | 2 +- + net/netfilter/nft_lookup.c | 2 +- + net/netfilter/nft_objref.c | 2 +- + 5 files changed, 16 insertions(+), 3 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 3ed21d2d56590..2e24ea1d744c2 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -619,6 +619,7 @@ struct nft_set_binding { + }; + + enum nft_trans_phase; ++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set); + void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, + struct nft_set_binding *binding, + enum nft_trans_phase phase); +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 8b6c61a2196cb..59fb8320ab4d7 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5127,12 +5127,24 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, + } + } + ++void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) ++{ ++ if (nft_set_is_anonymous(set)) ++ nft_clear(ctx->net, set); ++ ++ set->use++; ++} ++EXPORT_SYMBOL_GPL(nf_tables_activate_set); ++ + void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, + struct nft_set_binding *binding, + enum nft_trans_phase phase) + { + switch (phase) { + case NFT_TRANS_PREPARE: ++ if (nft_set_is_anonymous(set)) ++ nft_deactivate_next(ctx->net, set); ++ + set->use--; + return; + case NFT_TRANS_ABORT: +diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c +index 274579b1696e0..bd19c7aec92ee 100644 +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -342,7 +342,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx, + { + struct nft_dynset *priv = nft_expr_priv(expr); + +- priv->set->use++; ++ nf_tables_activate_set(ctx, priv->set); + } + + static void nft_dynset_destroy(const struct nft_ctx *ctx, +diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c +index cecf8ab90e58f..03ef4fdaa460b 100644 +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -167,7 +167,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx, + { + struct nft_lookup *priv = nft_expr_priv(expr); + +- priv->set->use++; ++ nf_tables_activate_set(ctx, priv->set); + } + + static void nft_lookup_destroy(const struct nft_ctx *ctx, +diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c +index cb37169608bab..a48dd5b5d45b1 100644 +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -185,7 +185,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx, + { + struct nft_objref_map *priv = nft_expr_priv(expr); + +- priv->set->use++; ++ nf_tables_activate_set(ctx, priv->set); + } + + static void nft_objref_map_destroy(const struct nft_ctx *ctx, +-- +cgit + -- 2.38.1

2 1

[PATCH] backup.cgi: Read and deliver the requested backup in pieces
by Stefan Schantl 10 May '23

10 May '23

Read-in the requested backup file line by line and directly deliver this as stream to the client. This fixes the problem with very big backups on systems with very limited RAM, which resulted in an OOM kill of the CGI and delivery process. Fixes #13096. Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- html/cgi-bin/backup.cgi | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/html/cgi-bin/backup.cgi b/html/cgi-bin/backup.cgi index 1c01cb286..3888ccbff 100644 --- a/html/cgi-bin/backup.cgi +++ b/html/cgi-bin/backup.cgi @@ -366,6 +366,13 @@ sub deliver_file() { # Deliver content open(FILE, "<$file") or die "Unable to open $file: $!"; - print <FILE>; + + # Read the file line by line and send it + # to the client. + while (<FILE>) { + print $_; + } + + # Close file handle. close(FILE); } -- 2.30.2

2 1

Problem building python3-flit_scm for use with borgbackup
by Adolf Belka 09 May '23

09 May '23

Hi All, I have figured out why the fuse mount stopped working with borgbackup in Core Update 173. (Bug#13076) python3-trio was updated when python was updated to 3.10.8 and python3-trio is required by python3-pyfuse3. However the python3-trio update also added a new dependency - python3-exceptiongroup which then requires python3-flit_scm for the build of python3-exceptiongroup. Both python3-exceptiongroup and python3-flit_scm use pyproject.toml, however python3-pyproject2setuppy fails with trying to build python3-flit_scm as it does not understand the backend definition in the pyproject.toml file. The error message is :- File "/usr/lib/python3.10/site-packages/pyproject2setuppy/__main__.py", line 50, in main raise NotImplementedError( NotImplementedError: Build backend flit_scm:buildapi unknown pyproject2setuppy is now marked as DEFUNCT due to the number of special cases in the pyproject.toml file that needed lots of work each time to update pyproject2setuppy to work again. Does anyone have any idea how I should build flit_scm and exceptiongroup without using pyproject2setuppy. I have done some searching but could not find anything that I could either understand or that did not require internet access to download all required dependencies. Regards, Adolf.

2 4

[PATCH] harfbuzz: Update to version 7.2.0
by Adolf Belka 09 May '23

09 May '23

- Update from version 7.0.1 to 7.2.0 - Update of rootfile - Changelog Overview of changes leading to 7.2.0 - Add Tifinagh to the list of scripts that can natively be either right-to-left or left-to-right, to improve handling of its glyph positioning. (Simon Cozens) - Return also single substitution from hb_ot_layout_lookup_get_glyph_alternates() (Behdad Esfahbod) - Fix 4.2.0 regression in applying across syllables in syllabic scripts. (Behdad Esfahbod) - Add flag to avoid glyph substitution closure during subsetting, and the corresponding “--no-layout-closure” option to “hb-subset” command line tool. (Garret Rieger) - Support instancing COLRv1 table. (Qunxin Liu) - Don’t drop used user-defined name table entries during subsetting. (Qunxin Liu) - Optimize handling of “gvar” table. (Behdad Esfahbod) - Various subsetter bug fixes and improvements. (Garret Rieger, Qunxin Liu) - Various documentation improvements. (Behdad Esfahbod, Josef Friedrich) - New API: +HB_SUBSET_FLAGS_NO_LAYOUT_CLOSURE +HB_UNICODE_COMBINING_CLASS_CCC132 - Deprecated API: +HB_UNICODE_COMBINING_CLASS_CCC133 Overview of changes leading to 7.1.0 - New experimental hb_shape_justify() API that uses font variations to expand or shrink the text to a given advance. (Behdad Esfahbod) - Various build and bug fixes. (Behdad Esfahbod, Garret Rieger, Qunxin Liu) - New API: +hb_font_set_variation() Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/harfbuzz | 7 ++++--- lfs/harfbuzz | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/harfbuzz b/config/rootfiles/common/harfbuzz index b18e30a18..4798653a2 100644 --- a/config/rootfiles/common/harfbuzz +++ b/config/rootfiles/common/harfbuzz @@ -44,15 +44,15 @@ #usr/lib/libharfbuzz-cairo.la #usr/lib/libharfbuzz-cairo.so usr/lib/libharfbuzz-cairo.so.0 -usr/lib/libharfbuzz-cairo.so.0.60701.0 +usr/lib/libharfbuzz-cairo.so.0.60720.0 #usr/lib/libharfbuzz-subset.la #usr/lib/libharfbuzz-subset.so usr/lib/libharfbuzz-subset.so.0 -usr/lib/libharfbuzz-subset.so.0.60701.0 +usr/lib/libharfbuzz-subset.so.0.60720.0 #usr/lib/libharfbuzz.la #usr/lib/libharfbuzz.so usr/lib/libharfbuzz.so.0 -usr/lib/libharfbuzz.so.0.60701.0 +usr/lib/libharfbuzz.so.0.60720.0 #usr/lib/pkgconfig/harfbuzz-cairo.pc #usr/lib/pkgconfig/harfbuzz-subset.pc #usr/lib/pkgconfig/harfbuzz.pc @@ -127,6 +127,7 @@ usr/lib/libharfbuzz.so.0.60701.0 #usr/share/gtk-doc/html/harfbuzz/api-index-5-3-0.html #usr/share/gtk-doc/html/harfbuzz/api-index-6-0-0.html #usr/share/gtk-doc/html/harfbuzz/api-index-7-0-0.html +#usr/share/gtk-doc/html/harfbuzz/api-index-7-1-0.html #usr/share/gtk-doc/html/harfbuzz/api-index-full.html #usr/share/gtk-doc/html/harfbuzz/apple-advanced-typography-api.html #usr/share/gtk-doc/html/harfbuzz/buffers-language-script-and-direction.html diff --git a/lfs/harfbuzz b/lfs/harfbuzz index 17186b203..15cc9ff13 100644 --- a/lfs/harfbuzz +++ b/lfs/harfbuzz @@ -24,7 +24,7 @@ include Config -VER = 7.0.1 +VER = 7.2.0 THISAPP = harfbuzz-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4a8844093b627b8d5d2e6f7b735781334f2715fe5146bb135ba19fb5a38f2a38248028b447d985fbde4505cd66721766a727fa7fe1300efd31259c7cafb8b6f2 +$(DL_FILE)_BLAKE2 = 247746d6a0f132a0d6b0c461d9e96a4fe76bc08bca4d05b28a034de60afee8e049d798fdf3962b892b33424245d8f00a63d6068b034e80ad9d7733180e8533c1 install : $(TARGET) -- 2.40.1

3 11

[PATCH 1/2] rng-tools: Update to version 2.16
by Adolf Belka 09 May '23

09 May '23

- Update from version 2.14 to 2.16 - Update of rootfile not required - Version 2.16 required libcap to be available, which it is, but it could not be found by rng-tools. This is because rng-tools is using pkg-config and the required libcap.pc file was not stored in the standard directory location for .pc files. Therefore a patch for libcap is bundled together with this update to fix this. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/rng-tools | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lfs/rng-tools b/lfs/rng-tools index 6a85a8482..8c9c338cf 100644 --- a/lfs/rng-tools +++ b/lfs/rng-tools @@ -24,7 +24,7 @@ include Config -VER = 6.14 +VER = 6.16 SUMMARY = This is a random number generator daemon THISAPP = rng-tools-$(VER) @@ -33,7 +33,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = rng-tools -PAK_VER = 1 +PAK_VER = 2 DEPS = @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 177065f9ea68b68459d034d38278f866a0c9d5c499578fabcc29ceb387b49667393f23dcae9f13ff401599846e872dbada73f5e319a99dfa4605cdb77ee3e896 +$(DL_FILE)_BLAKE2 = ab1a84c9a298e71ea5cdc1e91004ac069199a0128ee9701b1b3e24b6c705c63a642ab3db260a2c6c910c185e8fc75d5775caa3b7c370f102c75fac496e9bca17 install : $(TARGET) @@ -81,8 +81,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && ./autogen.sh - cd $(DIR_APP) && ./configure \ - --prefix=/usr \ + cd $(DIR_APP) && echo libcap_LIBS && ./configure \ + --prefix=/usr \ --without-pkcs11 \ --without-rtlsdr cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) -- 2.40.1

2 3

[PATCH v2 1/4] alsa: Fix bug#13087 remove services entry
by Adolf Belka 08 May '23

08 May '23

- alsa has an initscript but it is not starting and stopping a traditional daemon service. The initscript loads some alsa modules and then restores the asound.state file - This patch updates the PAK_VER number and removes the services entry and explicitly adds alsa in for the initscript installation. - Additionally this patch also adds the installation of a backup include file for alsa which savces the soundcards status file asound.state Fixes: Bug#13087 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/alsa | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lfs/alsa b/lfs/alsa index 2d89af880..db7afe4b1 100644 --- a/lfs/alsa +++ b/lfs/alsa @@ -37,11 +37,11 @@ DL_FILE = $(THISAPP).tar.bz2 DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) PROG = alsa -PAK_VER = 15 +PAK_VER = 16 DEPS = -SERVICES = alsa +SERVICES = TARGET = $(DIR_INFO)/$(THISAPP) @@ -104,6 +104,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP)/alsa-firmware-$(FVER) && make $(MAKETUNING) $(EXTRA_MAKE) cd $(DIR_APP)/alsa-firmware-$(FVER) && make install # install initscript - $(call INSTALL_INITSCRIPTS,$(SERVICES)) + $(call INSTALL_INITSCRIPTS,alsa) + # install backup include file + install -v -m 644 ${DIR_SRC}/config/backup/includes/alsa \ + /var/ipfire/backup/addons/includes/alsa @rm -rf $(DIR_SRC)/alsa* @$(POSTBUILD) -- 2.40.1

1 3

[PATCH] memtest: update to memtest86+ 6.10
by Arne Fitzenreiter 05 May '23

05 May '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/memtest | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/memtest b/lfs/memtest index 0e10533b6..a26beaef4 100644 --- a/lfs/memtest +++ b/lfs/memtest @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 6.01 +VER = 6.10 THISAPP = memtest86plus-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 429df2d71cb0d84bec9aa3a25023f2a9db2e8c01b32b0af1f42b689a4a7da192d5ddb77a5cb126a162aba0c1e704a2da8f5dee88caae0d9f78545e9e9c14eee9 +$(DL_FILE)_BLAKE2 = 2462c31f1ca27aa166c447e51a9b388872faaf7f845100a122f5dd8eb11dc76e26c503dc14d0825bda397c7180a5259094a020d25dd9d43b1997bfbe424c7f65 install : $(TARGET) -- 2.38.1

1 0

[PATCH] clamav: Update to 1.1.0
by Matthias Fischer 03 May '23

03 May '23

For details see: https://blog.clamav.net/2023/05/clamav-110-released.html "Major changes Added the ability to extract images embedded in HTML CSS <style> blocks. Updated to Sigtool so that the --vba option will extract VBA code from Microsoft Office documents the same way that libclamav extracts VBA. This resolves several issues where Sigtool could not extract VBA. Sigtool will also now display the normalized VBA code instead of the pre-normalized VBA code. Added a new ClamScan and ClamD option: --fail-if-cvd-older-than=days. Additionally, we introduce FailIfCvdOlderThan as a clamd.conf synonym for --fail-if-cvd-older-than. When passed, it causes ClamD to exit on startup with a non-zero return code if the virus database is older than the specified number of days. Added a new function cl_cvdgetage() to the libclamav API. This function will retrieve the age in seconds of the youngest file in a database directory, or the age of a single CVD (or CLD) file. Added a new function cl_engine_set_clcb_vba() to the libclamav API. Use this function to set a cb_vba callback function. The cb_vba callback function will be run whenever VBA is extracted from office documents. The provided data will be a normalized copy of the extracted VBA. This callback was added to support Sigtool so that it can use the same VBA extraction logic that ClamAV uses to scan documents. Other improvements Removed the vendored TomsFastMath library in favor of using OpenSSL to perform "big number"/multiprecision math operations. Work courtesy of Sebastian Andrzej Siewior. Build system: Added CMake option DO_NOT_SET_RPATH to avoid setting RPATH on Unix systems. Feature courtesy of Sebastian Andrzej Siewior. Build system: Enabled version-scripts with CMake to limit symbol exports for libclamav, libfreshclam, libclamunrar_iface, and libclamunrar shared libraries on Unix systems, excluding macOS. Improvement courtesy of Orion Poplawski and Sebastian Andrzej Siewior. Build system: Enabled users to pass in custom Rust compiler flags using the RUSTFLAGS CMake variable. Feature courtesy of Orion Poplawski. Removed a hard-coded alert for CVE-2004-0597. The CVE is old enough that it is no longer a threat and the detection had occasional false-positives. Set Git attributes to prevent Git from altering line endings for Rust vendored libraries. Third-party Rust libraries are bundled in the ClamAV release tarball. We do not commit them to our own Git repository, but community package maintainers may now store the tarball contents in Git. The Rust build system verifies the library manifest, and this change ensures that the hashes are correct. Improvement courtesy of Nicolas R. Fixed compile time warnings. Improvement courtesy of Razvan Cojocaru. Added a minor optimization when matching domain name regex signatures for PDB, WDB and CDB type signatures. Build system: Enabled the ability to select a specific Python version. When building, you may use the CMake option -D PYTHON_FIND_VER=<version> to choose a specific Python version. Feature courtesy of Matt Jolly. Added improvements to the ClamOnAcc process log output so that it is easier to diagnose bugs. Windows: Enabled the MSI installer to upgrade between feature versions more easily when ClamAV is installed to a location different from the default (i.e., not C:\Program Files\ClamAV). This means that the MSI installer can find a previous ClamAV 1.0.x installation to upgrade to ClamAV 1.1.0. Sigtool: Added the ability to change the location of the temp directory using the --tempdir option and added the ability to retain the temp files created by Sigtool using the --leave-temps option. Other minor improvements. Bug fixes Fixed the broken ExcludePUA / --exclude-pua feature. Fix courtesy of Ged Haywood and Shawn Iverson. Fixed an issue with integer endianness when parsing Windows executables on big-endian systems. Fix courtesy of Sebastian Andrzej Siewior. Fixed a possible stack overflow read when parsing WDB signatures. This issue is not a vulnerability. Fixed a possible index out of bounds when loading CRB signatures. This issue is not a vulnerability. Fixed a possible use after free when reading logical signatures. This issue is not a vulnerability. Fixed a possible heap overflow read when reading PDB signatures. This issue is not a vulnerability. Fixed a possible heap overflow read in javascript normalizer module. This issue is not a vulnerability. Fixed two bugs that would cause Freshclam to fail update when applying a CDIFF database patch if that patch adds a file to the database archive or removes a file from the database archive. This bug also caused Sigtool to fail to create such a patch. Fixed an assortment of complaints identified by Coverity static analysis. Fixed one of the Freshclam tests that was failing on some Fedora systems due to a bug printing debug-level log messages to stdout. Fix courtesy of Arjen de Korte. Correctly remove temporary files generated by the VBA and XLM extraction modules so that the files are not leaked in patched versions of ClamAV where temporary files are written directly to the temp-directory instead of writing to a unique subdirectory." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/packages/clamav | 16 ++++++++-------- lfs/clamav | 6 +++--- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index fd3c4c0c9..d49a12d52 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -13,20 +13,20 @@ usr/bin/sigtool #usr/include/clamav.h #usr/include/libfreshclam.h usr/lib/libclamav.so -usr/lib/libclamav.so.11 -usr/lib/libclamav.so.11.0.0 +usr/lib/libclamav.so.12 +usr/lib/libclamav.so.12.0.0 usr/lib/libclammspack.so usr/lib/libclammspack.so.0 usr/lib/libclammspack.so.0.8.0 usr/lib/libclamunrar.so -usr/lib/libclamunrar.so.11 -usr/lib/libclamunrar.so.11.0.0 +usr/lib/libclamunrar.so.12 +usr/lib/libclamunrar.so.12.0.0 usr/lib/libclamunrar_iface.so -usr/lib/libclamunrar_iface.so.11 -usr/lib/libclamunrar_iface.so.11.0.0 +usr/lib/libclamunrar_iface.so.12 +usr/lib/libclamunrar_iface.so.12.0.0 usr/lib/libfreshclam.so -usr/lib/libfreshclam.so.2 -usr/lib/libfreshclam.so.2.0.2 +usr/lib/libfreshclam.so.3 +usr/lib/libfreshclam.so.3.0.0 #usr/lib/pkgconfig/libclamav.pc usr/sbin/clamd #usr/share/doc/ClamAV diff --git a/lfs/clamav b/lfs/clamav index 426321c05..eeb0df5b2 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -26,7 +26,7 @@ include Config SUMMARY = Antivirus Toolkit -VER = 1.0.1 +VER = 1.1.0 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 65 +PAK_VER = 66 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 8f216051eeb94a9196849c9edff2fe0c73e4aa3ca242cf72d91c1692eb2a4688f8e525f638b6870a2f934976435a4272a1f116c1cf3a7cfd194efa91f11fd135 +$(DL_FILE)_BLAKE2 = 6a30558b8e6d2f8d98eb0b990e58ec9a19d7f58b11863ec5dffe97f45c73c1ea8bb0360456193c76d178068ee5eb7f01fc44851eb7bf90d42ca9dd9431413a4f install : $(TARGET) -- 2.34.1

1 0

[PATCH] squid: Update to 5.9
by Matthias Fischer 03 May '23

03 May '23

For details see: https://github.com/squid-cache/squid/commits/v5 The translation files are back in the source code... ;-) Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/lfs/squid b/lfs/squid index 5d79bf382..bc0682031 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,8 +24,7 @@ include Config -VER = 5.8 -LANGPACK = 20230225 +VER = 5.9 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -43,14 +42,11 @@ endif # Top-level Rules ############################################################################### -objects = $(DL_FILE) \ - squid-langpack-$(LANGPACK).tar.gz +objects = $(DL_FILE) -$(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) -squid-langpack-$(LANGPACK).tar.gz = $(URL_IPFIRE)/squid-langpack-$(LANGPACK).tar.gz +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = c9d1ae9464e68beabdf7ae1641a70d6c614bc4d4f4bae3fc5946c2bf61510634992cbd5abe63f071104edb2fa487a6c5c7fb8fbf8f06ac723a6522ec9ade8b68 -squid-langpack-$(LANGPACK).tar.gz_BLAKE2 = 169a05d16770f56e515fd633658e8bcd9464fb01ccba76256b119932c833af7bc22e3e8d3a7d5fde37638546f15822a4d1548a78af13be9f4e3b8989758250b6 +$(DL_FILE)_BLAKE2 = 898a34357f8019291379ea37c66fa312e1a6437e8f643987dd4e54d7d52728248e16129b00195c5f6e0378c0f32c9f9ade3f98ca0ec4bb952f9f443357face82 install : $(TARGET) @@ -80,7 +76,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP)/errors && tar zxf $(DIR_DL)/squid-langpack-$(LANGPACK).tar.gz cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squid/01_squid-gcc11.patch -- 2.34.1

1 0

Problem building a version update of rng-tools
by Adolf Belka 03 May '23

03 May '23

Hi All, There is a new version for rng-tools so I thought I would do an update but it kept stopping saying that it required libcap and could not find it. I noted that the libcap libs are in /lib and not in /usr/lib as the other packages that rng-tools looks for have their libs. (openssl, libxml2, curl, jansson) The new version has a flag for the ./configure called libcap_LIBS which can be used to override pkg-config. I tried that in various ways such as libcap_LIBS="/lib" or libcap_LIBS="/lib/libcap.so.2.67" and others, but none of them worked. The ./configure still ended up with the message checking for libcap... no configure: error: libcap is required I then noticed that libcap.pc is in /lib/pkgconfig/ while all the other packages being searched for are in /usr/lib/pkgconfig/ I then manually did a copy of libcap.pc to /usr/lib/pkgconfig/ and then re ran just the rng-tools build and it then successfully found libcap and completed the build. So the problem is definitely to do withy the unusual location for the library files of libcap. So the question I have is what is the best way to deal with this. Should I add into the libcap lfs a line that copies the libcap.pc to /usr/lib/pkgconfig/ or is can someone tell me what I am doing wrong with the libcap_LIBS flag for ./configure Regards, Adolf.

2 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2023