From f39ae602acb834fffe6cd1d7062f898e55056fb0 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Mon, 27 Sep 2021 23:18:37 +0200 Subject: [PATCH] package/atftp: security bump to version 0.7.5 - Fix CVE-2021-41054: tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options. - Update hash of license file (license replaced with current version of the GPL text: https://sourceforge.net/p/atftp/code/ci/bf22ccaef34f5dcdbd48de8b0bea3ef97b9d3545) https://sourceforge.net/p/atftp/code/ci/v0.7.5/tree/Changelog Signed-off-by: Fabrice Fontaine Signed-off-by: Arnout Vandecappelle (Essensium/Mind) --- package/atftp/atftp.hash | 4 ++-- package/atftp/atftp.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/atftp/atftp.hash b/package/atftp/atftp.hash index 158e9e3b33..6b0d9a5879 100644 --- a/package/atftp/atftp.hash +++ b/package/atftp/atftp.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 d3c9cd0d971dfc786d7a5f4055c35d4e66aafc8102ac03473ef225bdf7edb26a atftp-0.7.4.tar.gz -sha256 32b1062f7da84967e7019d01ab805935caa7ab7321a7ced0e30ebe75e5df1670 LICENSE +sha256 93c87a4fb18218414e008e01c995dadd231ba4c752d0f894b34416d1e6d3038a atftp-0.7.5.tar.gz +sha256 86dc744860e6dfacfeba2f33fea908db03fe67c7e37a878285b7aae8e4596735 LICENSE diff --git a/package/atftp/atftp.mk b/package/atftp/atftp.mk index 3db966c169..70ef4c0fae 100644 --- a/package/atftp/atftp.mk +++ b/package/atftp/atftp.mk @@ -4,7 +4,7 @@ # ################################################################################ -ATFTP_VERSION = 0.7.4 +ATFTP_VERSION = 0.7.5 ATFTP_SITE = http://sourceforge.net/projects/atftp/files ATFTP_LICENSE = GPL-2.0+ ATFTP_LICENSE_FILES = LICENSE