[oe-commits] Roy Li : unzip: Security Advisory -CVE-2014-9636 and CVE-2015-1315

[git at git.openembedded.org]

Module: openembedded-core.git
Branch: fido
Commit: d868f9e8a6a5d4dc9c38e2881a329f7e3210eab8
URL:    http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=d868f9e8a6a5d4dc9c38e2881a329f7e3210eab8

Author: Roy Li <rongqing.li at windriver.com>
Date:   Wed Apr 29 08:53:35 2015 +0800

unzip: Security Advisory -CVE-2014-9636 and CVE-2015-1315

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9636

unzip 6.0 allows remote attackers to cause a denial of service
(out-of-bounds read or write and crash) via an extra field with
an uncompressed size smaller than the compressed field size in a
zip archive that advertises STORED method compression.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1315

Buffer overflow in the charset_to_intern function in unix/unix.c in
Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code
via a crafted string, as demonstrated by converting a string from CP866
to UTF-8.

(From OE-Core rev: f86a178fd7036541a45bf31a46bddf634c133802)

Signed-off-by: Roy Li <rongqing.li at windriver.com>
Signed-off-by: Ross Burton <ross.burton at intel.com>
Signed-off-by: Richard Purdie <richard.purdie at linuxfoundation.org>

---

 .../06-unzip60-alt-iconv-utf8_CVE-2015-1315.patch  | 402 +++++++++++++++++++++
 .../unzip/unzip/unzip-6.0_overflow3.diff           |  45 +++
 meta/recipes-extended/unzip/unzip_6.0.bb           |   5 +-
 3 files changed, 451 insertions(+), 1 deletion(-)

Diff:   http://git.openembedded.org/?p=openembedded-core.git/?a=commitdiff;h=d868f9e8a6a5d4dc9c38e2881a329f7e3210eab8