kumquat-buildroot/package/atftp/atftp.hash

# Locally computed
sha256 1ad080674e9f974217b3a703e7356c6c8446dc5e7b2014d0d06e1bfaa11b5041  atftp-0.7.2.tar.gz
sha256 32b1062f7da84967e7019d01ab805935caa7ab7321a7ced0e30ebe75e5df1670  LICENSE
atftp: add hash file Adding a hash file will allow autobuilders to detect that the files they have downloaded is invalid. It will be removed, and then re-downloaded in a followup build. Should fix issues such as: http://autobuild.buildroot.org/results/939/93963514fc42d481808b1a046f3e1376286bdae2/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> 2014-10-06 09:30:47 +02:00			`# Locally computed`
package/atftp: security bump to version 0.7.2 Fixes the following security issues: CVE-2019-11365: An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c. CVE-2019-11366: An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next. For details, see https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities Patch 0001-Makefile.am-link-against-libpthread-for-atftp.patch patches Makefile.am, so add _AUTORECONF. CFLAGS is now correctly handled since commit f9dbb96844167f (configure.ac: fix hard setting of CFLAGS), so drop the workaround about passing -fgnu89-inline in CPPFLAGS. Add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: Ryan Barnett <ryan.barnett@rockwellcollins.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2019-05-08 08:35:19 +02:00			`sha256 1ad080674e9f974217b3a703e7356c6c8446dc5e7b2014d0d06e1bfaa11b5041 atftp-0.7.2.tar.gz`
			`sha256 32b1062f7da84967e7019d01ab805935caa7ab7321a7ced0e30ebe75e5df1670 LICENSE`