Changeset 217c80c

Timestamp:

07/22/2024 04:44:19 PM (8 weeks ago)

Author:

Douglas R. Reno <renodr@…>

Branches:

12.2, lazarus, trunk, xry111/for-12.3, xry111/spidermonkey128

Children:

ffc112c6

Parents:

3981c8d

Message:

vorbis-tools: fix CVE-2023-43361 in oggenc.

Also make some style adjustments, and remove the --without-curl option
since it doesn't seem to do anything now.

Files:

• introduction/welcome/changelog.xml (modified) (1 diff)
• multimedia/audioutils/vorbistools.xml (modified) (5 diffs)

introduction/welcome/changelog.xml

@@ -42 +42 @@
       <para>July 22nd, 2024</para>
       <itemizedlist>
+        <listitem>
+          <para>[renodr] - Fix CVE-2023-43361 in vorbis-tools (Security Update).
+          Fixes <ulink url="&blfs-ticket-root;20125">#20125</ulink>.</para>
+        </listitem>
         <listitem>
           <para>[renodr] - Fix building compface with GCC 14. Fixes

multimedia/audioutils/vorbistools.xml

@@ -29 +29 @@
       The <application>Vorbis Tools</application> package contains
       command-line tools useful for encoding, playing or editing
-      files using the Ogg CODEC.
+      files using the Ogg codec.
     </para>
 
@@ -95 +95 @@
 
     <para>
-      First, apply a sed to fix a gcc-14 issues:
+      First, apply a sed to fix a gcc-14 issue:
     </para>
 
 <screen><userinput remap="pre">sed -i '/i18n.h/i #include "utf8.h"' ogginfo/codec_skeleton.c</userinput></screen>
+
+    <para>
+      Next, apply a sed to fix a security vulnerability in 'oggenc':
+    </para>
+
+<screen><userinput remap="pre">sed -i 's/start+1,/start + strspn(start, PATH_SEPS),/' oggenc/platform.c</userinput></screen>
 
     <para>
@@ -105 +111 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr \
-            --enable-vcut \
-            --without-curl &amp;&amp;
+<screen><userinput>./configure --prefix=/usr --enable-vcut &amp;&amp;
 make</userinput></screen>
 
@@ -130 +134 @@
     </para>
 
-    <para>
-      <parameter>--without-curl</parameter>: This parameter disables HTTP
+<!--
+    <para>
+      <parameter>- -without-curl</parameter>: This parameter disables HTTP
       streaming in <command>ogg123</command>. Remove this parameter if you have
       <application>cURL</application> installed.
     </para>
+-->
 
  </sect2>
@@ -188 +194 @@
       <seglistitem>
         <seg>
-          ogg123, oggdec, oggenc, ogginfo, vcut and vorbiscomment
+          ogg123, oggdec, oggenc, ogginfo, vcut, and vorbiscomment
         </seg>
         <seg>