Changeset 04131a2

Timestamp:

08/20/2024 09:43:43 PM (4 weeks ago)

Author:

Douglas R. Reno <renodr@…>

Branches:

12.2, lazarus, trunk

Children:

aa996df1

Parents:

ba7fffb

Message:

p7zip: fix CVE-2023-52168, CVE-2023-52169, and roll in the fix for
CVE-2021-3465 into the patch.

Files:

• general/sysutils/p7zip.xml (modified) (2 diffs)
• introduction/welcome/changelog.xml (modified) (1 diff)

general/sysutils/p7zip.xml

@@ -70 +70 @@
     </itemizedlist>
 
-<!-- Applied in 17.03
     <bridgehead renderas="sect3">Additional Downloads</bridgehead>
     <itemizedlist spacing='compact'>
       <listitem>
-        <para>Required patch: <ulink
-        url="&patch-root;/p7zip-&p7zip-version;-consolidated_fixes-1.patch"/></para>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/p7zip-&p7zip-version;-consolidated_fixes-1.patch"/>
+        </para>
       </listitem>
     </itemizedlist>
--->
 
     <bridgehead renderas="sect3">p7zip Dependencies</bridgehead>
@@ -93 +93 @@
     <title>Installation of p7zip</title>
 
-<!-- Applied in 17.03
-    <para>
-      First, update the package for gcc10 and some security issues:
+    <para>
+      First, fix several security vulnerabilities:
     </para>
 
 <screen><userinput>patch -Np1 -i ../p7zip-&p7zip-version;-consolidated_fixes-1.patch</userinput></screen>
--->
-
-    <para>
-      First, prevent <application>p7zip</application> from installing
+
+    <para>
+      Next, prevent <application>p7zip</application> from installing
       compressed manual pages:
     </para>
 
 <screen><userinput remap="pre">sed '/^gzip/d' -i install.sh</userinput></screen>
-
-    <para>
-      Next, fix a security vulnerability:
-    </para>
-
-<screen><userinput remap="pre">sed -i '160a if(_buffer == nullptr || _size == _pos) return E_FAIL;' CPP/7zip/Common/StreamObjects.cpp</userinput></screen>
 
     <para>

introduction/welcome/changelog.xml

@@ -39 +39 @@
     </listitem>
     -->
+    <listitem>
+      <para>August 20th, 2024</para>
+      <itemizedlist>
+        <listitem>
+          <para>[renodr] - Fix three security vulnerabilities in p7zip. Fixes
+          <ulink url="&blfs-ticket-root;20251">#20251</ulink>.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
     <listitem>
       <para>August 19th, 2024</para>