summaryrefslogtreecommitdiffstats
path: root/package/spice/0005-reds-Avoid-integer-overflows-handling-monitor-config.patch
Commit message (Collapse)AuthorAgeFilesLines
* spice: security bump to version 0.14.1Peter Korsgaard2018-10-201-31/+0
| | | | | | | | | | | | | | | | | | | Fixes CVE-2018-10873: A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially, other impacts. Drop patches as they are now upstream. Add host-pkgconf as the configure script uses pkg-config. Drop removed --disable-automated-tests configure flag. Add optional opus support, as that is now supported and needs to be explicitly disabled to not use. Explicitly disable optional gstreamer support for now as the dependency tree is fairly complicated. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: add upstream security fixes for CVE-2017-7506Peter Korsgaard2017-07-141-0/+31
Fixes CVE-2017-7506 - Possible buffer overflow via invalid monitor configurations. For more details, see: https://marc.info/?l=oss-security&m=150001782924095 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud