Age | Commit message (Collapse) | Author | Files | Lines |
|
archivers/unzip: security fix
Revisions pulled up:
- archivers/unzip/Makefile 1.91
- archivers/unzip/distinfo 1.29
- archivers/unzip/patches/patch-crypt.c 1.1
- archivers/unzip/patches/patch-extract.c 1.3
---
Module Name: pkgsrc
Committed By: wiz
Date: Wed Nov 11 12:47:27 UTC 2015
Modified Files:
pkgsrc/archivers/unzip: Makefile distinfo
pkgsrc/archivers/unzip/patches: patch-extract.c
Added Files:
pkgsrc/archivers/unzip/patches: patch-crypt.c
Log Message:
Add patches to fix CVE-2015-7696, CVE-2015-7697, and an integer underflow.
From Debian.
Bump PKGREVISION.
|
|
|
|
http://www.openwall.com/lists/oss-security/2015/02/11/7
Bump PKGREVISION.
|
|
http://seclists.org/oss-sec/2014/q4/497
Bump PKGREVISION.
|
|
Bump PKGREVISION.
Nudged by tez, thanks!
|
|
|
|
|
|
|
|
|
|
|
|
The CVS history doesn't explain why or on what platforms it is
needed.
If it is needed, please contact me with details.
|
|
|
|
|
|
PR 46383 by Uwe Klaus.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
of Georg Schwarz.
|
|
and add same for Darwin.
|
|
|
|
New features in UnZip 6.0, released 20 April 2009:
* Support PKWARE ZIP64 extensions, allowing Zip archives and Zip
archive entries larger than 4 GiBytes and more than 65536 entries
within a single Zip archive. This support is currently only
available for Unix, OpenVMS and Win32/Win64.
* Support for bzip2 compression method.
* Support for UTF-8 encoded entry names, both through PKWARE's
"General Purpose Flags Bit 11" indicator and Info-ZIP's new "up"
unicode path extra field. (Currently, on Windows the UTF-8
handling is limited to the character subset contained in the
configured non-unicode "system code page".)
* Added "wrong implementation used" warning to error messages of
the MSDOS port when used under Win32, in an attempt to reduce
false bug reports.
* Fixed "Time of Creation/Time of Use" vulnerability when setting
attributes of extracted files, for Unix and Unix-like ports.
* Fixed memory leak when processing invalid deflated data.
* Fixed long-standing bug in unshrink (partial_clear), added
boundary checks against invalid compressed data.
* On Unix, keep inherited SGID attribute bit for extracted
directories unless restoration of owner/group id or SUID/SGID/Tacky
attributes was requested.
* On Unix, allow extracted filenames to contain embedded control
characters when explicitly requested by specifying the new command
line option "-^".
* On Unix, support restoration of symbolic link attributes.
* On Unix, support restoration of 32-bit UID/GID data using the
new "ux" IZUNIX3 extra field introduced with Zip 3.0.
* Support for ODS5 extended filename syntax on new OpenVMS systems.
* Support symbolic links zipped up on VMS.
* On VMS (only 8.x or better), support symbolic link creation.
* On VMS, support option to create converted text files in
Stream_LF format.
* New -D option to suppress restoration of timestamps for extracted
directory entries (on those ports that support setting of directory
timestamps). By specifying "-DD", this new option also allows
to suppress timestamp restoration for ALL extracted files on
all UnZip ports which support restoration of timestamps. On
VMS, the default behaviour is now to skip restoration of
directory timestamps; here, "--D" restores ALL timestamps,
"-D" restores none.
* On OS/2, Win32, and Unix, the (previously optional) feature
UNIXBACKUP to allow saving backup copies of overwritten files on
extraction is now enabled by default.
For the UnZip 6.0 release, we want to give special credit to Myles
Bennet, who started the job of supporting ZIP64 extensions and
Large-File (> 2GiB) and provided a first (alpha-state) port.
|
|
OSI but it is derived from BSD so I added it to the acceptable set of
licenses.
|
|
|
|
|
|
|
|
|
|
from Debian. Bump package revision.
|
|
Adapt. Noted by Zafer Aydogan.
|
|
|
|
http://mail-index.netbsd.org/pkgsrc-users/2006/11/02/0003.html
|
|
|
|
|
|
|
|
developer is officially maintaining the package.
The rationale for changing this from "tech-pkg" to "pkgsrc-users" is
that it implies that any user can try to maintain the package (by
submitting patches to the mailing list). Since the folks most likely
to care about the package are the folks that want to use it or are
already using it, this would leverage the energy of users who aren't
developers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
USE_GNU_TOOLS -> USE_TOOLS
awk -> gawk
m4 -> gm4
make -> gmake
sed -> gsed
yacc -> bison
|
|
|
|
Relevant change,
+5.52 (28 Feb 05):
+ - win32/win32.c - defer_dir_attribs(): fixed critical "mem-access to
+ nirwana" bug when processing directory entries without any local
+ extra field; added some explaining comments
|
|
Changes:
The 5.52 maintenance release fixes a few minor problems found in the 5.51
release, closes some more security holes, adds a new AtheOS port, and
contains a Win32 extra-field code cleanup that was not finished earlier.
The most important changes are:
- (re)enabled unshrinking support by default, the LZW patents have expired
- fixed an extraction size bug for encrypted stored entries (12 excess bytes
were written with 5.51)
- fixed false "uncompressed size mismatch" messages when extracting encrypted
archive entries
- do not restore SUID/SGID/Tacky attribute bits on Unix (BeOS, AtheOS) unless
explicitely requested by new "-K" command line qualifier
- optional support for "-W" qualifier to modify the pattern matching syntax
(with -W: "*" stops at directory delimiter, "**" matches unlimited)
- prevent buffer overflow caused by bogus extra-long Zipfile specification
- performance enhancements for VMS port
- fixed windll interface handling of its extraction mode qualifiers nfflag,
ExtractOnlyNewer, noflag, PromptToOverwrite; added detailed explanation of
their meanings and interactions to the windll documentation
|
|
|