Changeset 5afb9db4

Timestamp:

02/10/2020 10:29:50 PM (5 years ago)

Author:

Douglas R. Reno <renodr@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 12.2, 9.1, gimp3, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/for-12.3, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/spidermonkey128, xry111/test-20220226, xry111/xf86-video-removal

Children:

81a47569

Parents:

61ae2f4

Message:

Add libexif security patch (fixes CVE-2019-9278). Thanks goes to Chris Gorman for the report.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22652 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:

• general/graphlib/libexif.xml (modified) (2 diffs)
• introduction/welcome/changelog.xml (modified) (1 diff)

general/graphlib/libexif.xml

@@ -74 +74 @@
     </itemizedlist>
 
+    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/libexif-&libexif-version;-security_fix-1.patch"/>
+        </para>
+      </listitem>
+    </itemizedlist>
+
     <bridgehead renderas="sect3">libexif Dependencies</bridgehead>
 
@@ -89 +99 @@
   <sect2 role="installation">
     <title>Installation of libexif</title>
+
+    <para>
+      First, apply a patch to fix a security issue (integer overflow):
+    </para>
+
+<screen><userinput remap="pre">patch -Np1 -i ../libexif-&libexif-version;-security_fix-1.patch</userinput></screen>
 
     <para>

introduction/welcome/changelog.xml

@@ -45 +45 @@
       <para>February 10th, 2020</para>
       <itemizedlist>
+        <listitem>
+          <para>[renodr] - Add a security patch to libexif to fix CVE-2019-9278,
+          an integer overflow vulnerability. Thanks goes to Chris Gorman for
+          the report.</para>
+        </listitem>
         <listitem>
           <para>[bdubbs] - Update to libgee-0.20.3. Fixes