From d6d032fc1efc8cb7bf870987023b196425cab445 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Fri, 6 Oct 2023 10:12:04 +0200 Subject: [PATCH] package/{glibc, localedef}: security bump to version glibc-2.36-118-g22955ad85186ee05834e47e665056148ca07699c CVE-2023-4911: If a tunable of the form NAME=NAME=VAL is passed in the environment of a setuid program and NAME is valid, it may result in a buffer overflow, which could be exploited to achieve escalated privileges. This flaw was introduced in glibc 2.34. Signed-off-by: Peter Korsgaard --- package/glibc/glibc.hash | 2 +- package/glibc/glibc.mk | 2 +- package/localedef/localedef.mk | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index 1a66b66984..dcff16d465 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,5 +1,5 @@ # Locally calculated (fetched from Github) -sha256 a4351e60a33e84236c1866c39eeab321f419dfdc274411b7d2615c9382ace351 glibc-2.36-117-g32957eb6a86acdbeec9f38a60a7d5a0ff32db03d.tar.gz +sha256 d7d829f90f03e00d42d7d34ff7e972a59b14e2b70fa2e852893018349aafa5f7 glibc-2.36-118-g22955ad85186ee05834e47e665056148ca07699c.tar.gz # Hashes for license files sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 42de53ffc5..a3a84e86ec 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -7,7 +7,7 @@ # Generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- # When updating the version, please also update localedef -GLIBC_VERSION = 2.36-117-g32957eb6a86acdbeec9f38a60a7d5a0ff32db03d +GLIBC_VERSION = 2.36-118-g22955ad85186ee05834e47e665056148ca07699c # Upstream doesn't officially provide an https download link. # There is one (https://sourceware.org/git/glibc.git) but it's not reliable, # sometimes the connection times out. So use an unofficial github mirror. diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk index e71424490b..51d3ddc932 100644 --- a/package/localedef/localedef.mk +++ b/package/localedef/localedef.mk @@ -7,7 +7,7 @@ # Use the same VERSION and SITE as target glibc # As in glibc.mk, generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- -LOCALEDEF_VERSION = 2.36-117-g32957eb6a86acdbeec9f38a60a7d5a0ff32db03d +LOCALEDEF_VERSION = 2.36-118-g22955ad85186ee05834e47e665056148ca07699c LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION)) HOST_LOCALEDEF_DL_SUBDIR = glibc