Commit Graph

15 Commits

Author SHA1 Message Date
Peter Korsgaard
9bf7844688 irssi: security bump to version 1.0.4
>From the advisory:
https://irssi.org/security/irssi_sa_2017_07.txt

Two vulnerabilities have been located in Irssi.

(a) When receiving messages with invalid time stamps, Irssi would try
    to dereference a NULL pointer. Found by Brian 'geeknik' Carpenter
    of Geeknik Labs. (CWE-690)

    CVE-2017-10965 [2] was assigned to this bug

(b) While updating the internal nick list, Irssi may incorrectly use
    the GHashTable interface and free the nick while updating it. This
    will then result in use-after-free conditions on each access of
    the hash table. Found by Brian 'geeknik' Carpenter of Geeknik
    Labs. (CWE-416 caused by CWE-227)

    CVE-2017-10966 [3] was assigned to this bug

Impact
------

(a) May result in denial of service (remote crash).

(b) Undefined behaviour.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-07-08 20:32:19 +02:00
Rodrigo Rebello
a97b1e03fe irssi: drop obsolete configure option
The configure option --with-ncurses has been removed in version 1.0.0
and thus is no longer needed.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-06-19 22:06:15 +02:00
Peter Korsgaard
2e19525f2f irssi: security bump to version 1.0.3
Fixes:

CVE-2017-9468 - Joseph Bisch discovered that Irssi does not properly handle
DCC messages without source nick/host.  A malicious IRC server can take
advantage of this flaw to cause Irssi to crash, resulting in a  denial of
service.

CVE-2017-9469 - Joseph Bisch discovered that Irssi does not properly handle
receiving incorrectly quoted DCC files.  A remote attacker can take
advantage of this flaw to cause Irssi to crash, resulting in a denial of
service.

See https://irssi.org/security/irssi_sa_2017_06.txt for more details.

Remove 0001-Get-back-to-using-pkg-config-to-check-for-OpenSSL.patch as it
applied upstream and drop autoreconf as configure.ac is no longer patched.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-06-19 22:06:10 +02:00
Rodrigo Rebello
deafcccdd4 irssi: fix attributes ordering in Config.in
According to the Buildroot convention, 'depends on' attributes shall
come before 'select' ones in Kconfig files.

Detected by check-package.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-04-12 21:02:30 +02:00
Rahul Bedarkar
af31c309e7 boot, linux, package: use SPDX short identifier for GPLv2/GPLv2+
We want to use SPDX identifier for license strings as much as possible.
SPDX short identifier for GPLv2/GPLv2+ is GPL-2.0/GPL-2.0+.

This change is done by using following command.
find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv2\>/GPL-2.0/g'

Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-04-01 15:16:38 +02:00
Rodrigo Rebello
fc741ba9b3 irssi: add patch to fix static linking
An upstream change which removed the option to build Irssi without SSL
support (v1.0.0 and later) also eliminated the use of PKG_CHECK_MODULES
to find the OpenSSL library, relying only on a test with AC_CHECK_LIB
for that purpose.

This unfortunately broke static linking since the flag to link with
zlib, used by OpenSSL, is missed completely.

The newly added patch therefore adds PKG_CHECK_MODULES back into the
configure script.

Fixes:

  http://autobuild.buildroot.net/results/e8b51f65525246d1205a26859d418393aaebf48c/
  http://autobuild.buildroot.net/results/35d952b3b36e295723bf8ed1badb4c9439201822/
  http://autobuild.buildroot.net/results/ea8af1458edf3ce0e2b1c444d2ae29ac1e5d2fbf/
  [...]

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-21 22:51:13 +01:00
Peter Korsgaard
d1e2d290d9 irssi: bump version to version 1.0.2
Notice that this fixes a security issue:

CWE-416 (use after free condition during netjoin processing). No CVE
assigned yet:

https://irssi.org/security/irssi_sa_2017_03.txt

But the 0.8.x series is not believed to be vulnerable to this specific
issue.  From the advisory:

Affected versions
-----------------

Irssi up to and including 1.0.1

We believe Irssi 0.8.21 and prior are not affected since a different
code path causes the netjoins to be flushed prior to reaching the use
after free condition.

Openssl is no longer optional, so select it and drop the enable/disable
handling.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-03-15 11:50:05 +01:00
Peter Korsgaard
8528edfb3b irssi: security bump to 0.8.21
Bugfixes:

- CVE-2017-5193: Correct a NULL pointer dereference in the nickcmp function
  found by Joseph Bisch (GL#1)

- CVE-2017-5194: Correct an error when receiving invalid nick message (GL#4,
  )

- CVE-2017-5195: Correct an out of bounds read in certain incomplete control
  codes found by Joseph Bisch (GL#2)

- CVE-2017-5196: Correct an out of bounds read in certain incomplete
  character sequences found by Hanno Böck and independently by J.  Bisch
  (GL#3)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2017-01-06 17:07:11 +01:00
Gustavo Zacarias
1b1d943fe1 irssi: security bump to version 0.8.20
Fixes two remote crash issues since version 0.8.17

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-09-25 23:13:40 +02:00
Rodrigo Rebello
9e44acf092 irssi: bump to version 0.8.19
Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2016-08-16 12:58:00 +02:00
Rodrigo Rebello
1a3c8498ab irssi: bump to version 0.8.18
Also remove no longer needed patch (merged upstream).

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2016-03-08 21:17:06 +01:00
Rodrigo Rebello
97767366f5 irssi: update download URL
Irssi source packages are now hosted on GitHub.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-12-17 21:53:00 +01:00
Rodrigo Rebello
934dd60eb5 irssi: change IRSSI_SITE back to original url
The official site is now back online.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-11-04 15:06:00 +01:00
Rodrigo Rebello
77ec184d99 irssi: add missing dependency on host-pkgconf
The irssi configure script uses pkg-config to detect the availability of
libglib2 and openssl.

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-11-03 20:49:09 +01:00
Rodrigo Rebello
26856b81e9 irssi: new package
Irssi is a terminal based IRC client for UNIX systems.

http://irssi.org/

[Thomas: use alternate site since the official site is currently
down.]

Signed-off-by: Rodrigo Rebello <rprebello@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-11-02 22:08:34 +01:00