NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
602488b91b
kumquat-buildroot/package/mpg123/mpg123.hash

8 lines
414 B
Plaintext
Raw Normal View History

package/mpg123: security bump to version 1.25.12 >From the release notes: - Fix an out-of-bounds read of maximal two bytes for truncated RVA2 frames (oss-fuzz-bug 15975). The earlier fix around the same location needed one thought more. Actually, another though was needed, oss-fuzz-bug 16009 documents the incomplete fix. - Fix an invalid write of one zero byte for empty ID3v2 frames that demand de-unsyncing (oss-fuzz-bug 16050). - Fix dynamic build with gcc -fsanitize=address (check for all dl functions before deciding that separate -ldl is not needed). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-25 08:47:37 +02:00
# From https://sourceforge.net/projects/mpg123/files/mpg123/1.25.12/
sha1 4ece1ec124a6ca085e1d68f7ede6d5619fc587ff mpg123-1.25.12.tar.bz2
md5 ddb38254966eb38c77f220d456a1839d mpg123-1.25.12.tar.bz2
package/mpg123: security bump to version 1.25.10 Version 1.25.4 fixes CVE-2017-9545, for details see release notes: http://www.mpg123.org/cgi-bin/news.cgi Added upstream hashes. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-06-10 14:09:10 +02:00
# Locally calculated
package/mpg123: security bump to version 1.25.12 >From the release notes: - Fix an out-of-bounds read of maximal two bytes for truncated RVA2 frames (oss-fuzz-bug 15975). The earlier fix around the same location needed one thought more. Actually, another though was needed, oss-fuzz-bug 16009 documents the incomplete fix. - Fix an invalid write of one zero byte for empty ID3v2 frames that demand de-unsyncing (oss-fuzz-bug 16050). - Fix dynamic build with gcc -fsanitize=address (check for all dl functions before deciding that separate -ldl is not needed). Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-25 08:47:37 +02:00
sha256 1ffec7c9683dfb86ea9040d6a53d6ea819ecdda215df347f79def08f1fe731d1 mpg123-1.25.12.tar.bz2
mpg123: security bump to version 1.25.2 >From the release notes: - Extend pow tables for layer III to properly handle files with i-stereo and 5-bit scalefactors. Never observed them for real, just as fuzzed input to trigger the read overflow. Note: This one goes on record as CVE-2017-11126, calling remote denial of service. While the accesses are out of bounds for the pow tables, they still are safely within libmpg123's memory (other static tables). Just wrong values are used for computation, no actual crash unless you use something like GCC's AddressSanitizer, nor any information disclosure. - Avoid left-shifts of negative integers in layer I decoding. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-07-11 12:28:57 +02:00
# License file
sha256 f40e0dd86b27b52e429b693a87b3ca63ae0a98a4d142e77207aa6bdf1db7a295 COPYING
Reference in New Issue Copy Permalink