mingw February 2015

mingw@lists.fedoraproject.org

3 participants
42 discussions

[Bug 1090976] CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled
by Red Hat Bugzilla 24 Feb '15

24 Feb '15

https://bugzilla.redhat.com/show_bug.cgi?id=1090976 Martin Prpic <mprpic(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1195649 Depends On| |1195650 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=33Y8w4m2iR&a=cc_unsubscribe

1 0

[Bug 1191079] CVE-2014-9657 freetype: off-by-one buffer over-read in tt_face_load_hdmx()
by Red Hat Bugzilla 20 Feb '15

20 Feb '15

https://bugzilla.redhat.com/show_bug.cgi?id=1191079 --- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> --- freetype-2.5.0-9.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Ze72x4DHjZ&a=cc_unsubscribe

1 0

[mingw-binutils/el6] Patch for PR 17754
by Erik van Pienbroek 19 Feb '15

19 Feb '15

commit 678cec3cc03ffdf0f6cf55c4667d7a745c0183bf Author: Erik van Pienbroek <epienbro(a)fedoraproject.org> Date: Thu Feb 19 21:23:17 2015 +0100 Patch for PR 17754 binutils-2.25-PR17754.patch | 29 +++++++++++++++++++++++++++++ mingw-binutils.spec | 7 ++++++- 2 files changed, 35 insertions(+), 1 deletion(-) --- diff --git a/binutils-2.25-PR17754.patch b/binutils-2.25-PR17754.patch new file mode 100644 index 0000000..8c1345a --- /dev/null +++ b/binutils-2.25-PR17754.patch @@ -0,0 +1,29 @@ +Upstream commit 60ebc25751744f54ae5c00d1c9198ab64fcc5b33: + +Fixes a buffer overflow when compiling assembler for the MinGW targets. + + PR binutils/17754 + * internal.h (internal_auxent): Increase size of x_fname field to + 20 to allow for PE format's longer file names. + +diff --git a/include/coff/internal.h b/include/coff/internal.h +index 8329564..c4f24bb 100644 +--- a/include/coff/internal.h ++++ b/include/coff/internal.h +@@ -588,7 +588,11 @@ union internal_auxent + + union + { +- char x_fname[FILNMLEN]; ++ /* PR 17754: We use to FILNMLEN for the size of the x_fname ++ array, but that cause problems as PE targets use a larger ++ value. We cannot use their definition of EFILNMLEN as this ++ header can be used without including any PE headers. */ ++ char x_fname[20]; + struct + { + long x_zeroes; +-- +1.9.4 + + diff --git a/mingw-binutils.spec b/mingw-binutils.spec index 4f4d6ff..c542a4d 100644 --- a/mingw-binutils.spec +++ b/mingw-binutils.spec @@ -2,7 +2,7 @@ Name: mingw-binutils Version: 2.25 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Cross-compiled version of binutils for Win32 and Win64 environments License: GPLv2+ and LGPLv2+ and GPLv3+ and LGPLv3+ @@ -11,6 +11,7 @@ Group: Development/Libraries URL: http://www.gnu.org/software/binutils/ Source0: http://ftp.gnu.org/gnu/binutils/binutils-%{version}.tar.bz2 #Source0: http://www.kernel.org/pub/linux/devel/binutils/binutils-%{version}.tar.bz2 +Patch0: binutils-2.25-PR17754.patch BuildRequires: flex BuildRequires: bison @@ -61,6 +62,7 @@ understand Windows executables and DLLs. %prep %setup -q -n binutils-%{version} +%patch0 -p1 %build @@ -247,6 +249,9 @@ rm -rf $RPM_BUILD_ROOT/multilib %changelog +* Wed Feb 18 2015 Yaakov Selkowitz <yselkowi(a)redhat.com> - 2.25-2 +- Patch for PR 17754. + * Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 2.25-1 - Update to 2.25

1 0

[mingw-binutils/el6] Update back to 2.25
by Erik van Pienbroek 19 Feb '15

19 Feb '15

commit 89443b47901475e362d616323cd6fff5ba86c2c1 Author: Erik van Pienbroek <epienbro(a)fedoraproject.org> Date: Thu Feb 19 21:16:50 2015 +0100 Update back to 2.25 This reverts commit 5523ce89f7c231e7fb4d912e8a20fe8e9153dee1. .gitignore | 1 + bfd_doc.txt | 36 --- binutils-2.24-cve_2014_8501.patch | 40 --- binutils-2.24-cve_2014_8502a.patch | 84 ------ binutils-2.24-cve_2014_8502pre.patch | 499 --------------------------------- binutils-2.24-cve_2014_8503.patch | 27 -- binutils-2.24-cve_2014_8504.patch | 33 --- binutils-2.24-cve_2014_8738.patch | 47 ---- binutils-2.24-dirtravel.patch | 150 ---------- binutils-2.24-set-section-macros.patch | 103 ------- mingw-binutils.spec | 32 +-- sources | 2 +- 12 files changed, 7 insertions(+), 1047 deletions(-) --- diff --git a/.gitignore b/.gitignore index 8b52d6a..bc3dab4 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ binutils-2.20.1.tar.bz2 /binutils-2.23.51.0.5.tar.bz2 /binutils-2.23.52.0.1.tar.bz2 /binutils-2.24.tar.bz2 +/binutils-2.25.tar.bz2 diff --git a/mingw-binutils.spec b/mingw-binutils.spec index 2911d62..4f4d6ff 100644 --- a/mingw-binutils.spec +++ b/mingw-binutils.spec @@ -1,8 +1,8 @@ %global run_testsuite 1 Name: mingw-binutils -Version: 2.24 -Release: 5%{?dist} +Version: 2.25 +Release: 1%{?dist} Summary: Cross-compiled version of binutils for Win32 and Win64 environments License: GPLv2+ and LGPLv2+ and GPLv3+ and LGPLv3+ @@ -24,22 +24,6 @@ BuildRequires: sharutils %endif Provides: bundled(libiberty) -# Resolve build failure on PPC -# Contributed by Kai Tietz -Patch0: bfd_doc.txt - -# Fix GCC 4.9 compatibility -Patch1: binutils-2.24-set-section-macros.patch - -# Fixes for various CVE's -Patch2: binutils-2.24-cve_2014_8501.patch -Patch3: binutils-2.24-cve_2014_8502pre.patch -Patch4: binutils-2.24-cve_2014_8502a.patch -Patch5: binutils-2.24-cve_2014_8503.patch -Patch6: binutils-2.24-cve_2014_8504.patch -Patch7: binutils-2.24-dirtravel.patch -Patch8: binutils-2.24-cve_2014_8738.patch - %description Cross compiled binutils (utilities like 'strip', 'as', 'ld') which @@ -77,15 +61,6 @@ understand Windows executables and DLLs. %prep %setup -q -n binutils-%{version} -%patch0 -p0 -%patch1 -p0 -%patch2 -p1 -b .cve_2014_8501 -%patch3 -p1 -b .cve_2014_8502pre -%patch4 -p1 -b .cve_2014_8502 -%patch5 -p1 -b .cve_2014_8503 -%patch6 -p2 -b .cve_2014_8504 -%patch7 -p1 -b .dirtravel -%patch8 -p1 -b .cve_2014_8738 %build @@ -272,6 +247,9 @@ rm -rf $RPM_BUILD_ROOT/multilib %changelog +* Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 2.25-1 +- Update to 2.25 + * Tue Dec 23 2014 Erik van Pienbroek <epienbro(a)fedoraproject.org> - 2.24-5 - Fix CVE-2014-8501 (RHBZ #1162578 #1162583) - Fix CVE-2014-8502 (RHBZ #1162602) diff --git a/sources b/sources index 1280421..272f6fd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -e0f71a7b2ddab0f8612336ac81d9636b binutils-2.24.tar.bz2 +d9f3303f802a5b6b0bb73a335ab89d66 binutils-2.25.tar.bz2

1 0

[Bug 1191079] CVE-2014-9657 freetype: off-by-one buffer over-read in tt_face_load_hdmx()
by Red Hat Bugzilla 19 Feb '15

19 Feb '15

https://bugzilla.redhat.com/show_bug.cgi?id=1191079 --- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> --- freetype-2.5.3-15.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=8Tevuwbtj0&a=cc_unsubscribe

1 0

[Bug 1191079] CVE-2014-9657 freetype: off-by-one buffer over-read in tt_face_load_hdmx()
by Red Hat Bugzilla 19 Feb '15

19 Feb '15

https://bugzilla.redhat.com/show_bug.cgi?id=1191079 Bug 1191079 depends on bug 1191099, which changed state. Bug 1191099 Summary: CVE-2014-9656 CVE-2014-9657 CVE-2014-9661 CVE-2014-9660 CVE-2014-9667 CVE-2014-9666 CVE-2014-9665 CVE-2014-9664 CVE-2014-9669 CVE-2014-9668 CVE-2014-9662 CVE-2014-9658 CVE-2014-9659 CVE-2014-9663 CVE-2014-9670 freetype: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1191099 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cPP75O410G&a=cc_unsubscribe

1 0

[Bug 1191079] CVE-2014-9657 freetype: off-by-one buffer over-read in tt_face_load_hdmx()
by Red Hat Bugzilla 19 Feb '15

19 Feb '15

1 0

[Bug 599567] New: mingw32-gcc should not drag in mingw32-pthreads
by Red Hat Bugzilla 18 Feb '15

18 Feb '15

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: mingw32-gcc should not drag in mingw32-pthreads https://bugzilla.redhat.com/show_bug.cgi?id=599567 Summary: mingw32-gcc should not drag in mingw32-pthreads Product: Fedora Version: 13 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: low Component: mingw32-gcc AssignedTo: rjones(a)redhat.com ReportedBy: eblake(a)redhat.com QAContact: extras-qa(a)fedoraproject.org CC: berrange(a)redhat.com, rjones(a)redhat.com, kalev(a)smartlink.ee, fedora-mingw(a)lists.fedoraproject.org Classification: Fedora Target Release: --- Description of problem: mingw32-gcc currently drags in a dependency on mingw32-pthreads, which in turn forces some namespace pollution due to its buggy <pthread.h> header. It would be much nicer if the mingw32-pthreads package remained optional, since it can interfere with cross-compilation efforts to mingw. Version-Release number of selected component (if applicable): mingw32-gcc-4.4.2-2.fc13.x86_64 mingw32-pthreads-2.8.0-10.fc13.noarch How reproducible: Always Steps to Reproduce: 1. Install mingw32-gcc Actual results: mingw32-pthreads gets sucked in as a required dependency to the cross-compiler. Expected results: Mere presence of the cross-compiler shouldn't force the existence of a broken <pthread.h>. Either the compiler needs to be built without mingw32-pthreads, or mingw32-pthreads needs to be split into two packages (runtime dependency of the compiler, vs. development library that installs <pthread.h> for situations that actually want to use this library in spite of its current upstream flaws). Additional info: -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 15

[Bug 641423] New: mingw32-gcc installs files both inside and outside the sysroot
by Red Hat Bugzilla 18 Feb '15

18 Feb '15

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: mingw32-gcc installs files both inside and outside the sysroot https://bugzilla.redhat.com/show_bug.cgi?id=641423 Summary: mingw32-gcc installs files both inside and outside the sysroot Product: Fedora Version: 13 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: low Component: mingw32-gcc AssignedTo: rjones(a)redhat.com ReportedBy: pbonzini(a)redhat.com QAContact: extras-qa(a)fedoraproject.org CC: rjones(a)redhat.com, kalev(a)smartlink.ee, fedora-mingw(a)lists.fedoraproject.org Classification: Fedora Target Release: --- Description of problem: mingw32-gcc is a strange hybrid package that installs files both inside and outside the sysroot. The files in the sysroot should be separated in mingw32-libgcc. Version-Release number of selected component (if applicable): mingw32-gcc-4.4.2-2.fc13.x86_64 Additional info: This makes the following packages depend incorrectly on mingw32-gcc: * mingw32-gettext (directly) * mingw32-pthreads (directly) * mingw32-atk (indirectly) * mingw32-glib2 (indirectly) * mingw32-gtk2 (indirectly) * mingw32-pango (indirectly) -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 11

[Bug 623338] New: mingw32-glib2 may need to be rebuilt against Python 2.7 in F14 and rawhide
by Red Hat Bugzilla 18 Feb '15

18 Feb '15

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: mingw32-glib2 may need to be rebuilt against Python 2.7 in F14 and rawhide https://bugzilla.redhat.com/show_bug.cgi?id=623338 Summary: mingw32-glib2 may need to be rebuilt against Python 2.7 in F14 and rawhide Product: Fedora Version: 14 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: low Component: mingw32-glib2 AssignedTo: rjones(a)redhat.com ReportedBy: dmalcolm(a)redhat.com QAContact: extras-qa(a)fedoraproject.org CC: lfarkas(a)lfarkas.org, t.sailer(a)alumni.ethz.ch, rjones(a)redhat.com, fedora-mingw(a)lists.fedoraproject.org Depends on: 623233 Blocks: 619913 Classification: Fedora Target Release: --- This is an automatically-filed bug. mingw32-glib2-2.24.1-1.fc14 contains one or more .pyc files, but has not been rebuilt since Python 2.7 was built for Fedora, and thus the .pyc files presumably are for Python 2.6. Python 2.7 changed the bytecode format, so usage of those files will typically fail (see e.g. bug 621726). The package needs to be rebuilt against python 2.7 in both F14 and devel. Information on the new "dist-git" system can be seen here: http://fedoraproject.org/wiki/Using_Fedora_GIT Information on common difficulties with Python 2.7 rebuilds can be seen here: https://fedoraproject.org/wiki/Features/Python_2.7 Once it's been successfully rebuilt for F14, an update needs to be filed to get the rebuild into F14: https://admin.fedoraproject.org/updates/new/ Please add this bug to the update, to make it easy to track what's been done, and what's left to do. I'm sorry that this component was not handled by the mass rebuild. (This may be due to bug 623233) -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

mingw February 2015