Ocaml-devel October 2009

ocaml-devel@lists.fedoraproject.org

5 participants
75 discussions

rpms/ocaml-mysql/devel ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch, NONE, 1.1 ocaml-mysql.spec, 1.10, 1.11
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-mysql/devel In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv17694 Modified Files: ocaml-mysql.spec Added Files: ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.0.4-11 - Patch for CVE 2009-2942 Missing escape function (RHBZ#529321). ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch: mysql.ml | 18 ++++++++++++------ mysql.mli | 5 +++++ mysql_stubs.c | 27 +++++++++++++++++++++++++++ 3 files changed, 44 insertions(+), 6 deletions(-) --- NEW FILE ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch --- diff -ur ocaml-mysql-1.0.4.orig/mysql.ml ocaml-mysql-1.0.4/mysql.ml --- ocaml-mysql-1.0.4.orig/mysql.ml 2006-02-23 22:13:22.000000000 +0000 +++ ocaml-mysql-1.0.4/mysql.ml 2009-10-16 11:42:08.074508283 +0100 @@ -333,6 +333,7 @@ external real_status : dbd -> int = "db_status" external errmsg : dbd -> string option = "db_errmsg" external escape : string -> string = "db_escape" +external real_escape: dbd -> string -> string = "db_real_escape" external fetch : result -> string option array option = "db_fetch" external to_row : result -> int64 -> unit = "db_to_row" external size : result -> int64 = "db_size" @@ -516,7 +517,9 @@ the corresponding type *) let ml2str str = "'" ^ escape str ^ "'" +let ml2rstr conn str = "'" ^ real_escape conn str ^ "'" let ml2blob = ml2str +let ml2rblob = ml2rstr let ml2int x = string_of_int x let ml2decimal x = x let ml322int x = Int32.to_string x @@ -524,12 +527,15 @@ let mlnative2int x = Nativeint.to_string x let ml2float x = string_of_float x let ml2enum x = escape x -let ml2set x = let rec loop arg = match arg with - | [] -> "" - | [x] -> escape x - | x::y::ys -> escape x ^ "," ^ loop (y::ys) - in - loop x +let ml2renum x = real_escape x +let ml2set_filter f x = + let rec loop f = function + | [] -> "" + | [x] -> f x + | x::y::ys -> f x ^ "," ^ loop f (y::ys) + in loop f x +let ml2set x = ml2set_filter escape x +let ml2rset conn x = ml2set_filter (real_escape conn) x let ml2datetimel ~year ~month ~day ~hour ~min ~sec = Printf.sprintf "'%04d-%02d-%02d %02d:%02d:%02d'" diff -ur ocaml-mysql-1.0.4.orig/mysql.mli ocaml-mysql-1.0.4/mysql.mli --- ocaml-mysql-1.0.4.orig/mysql.mli 2006-02-23 22:13:22.000000000 +0000 +++ ocaml-mysql-1.0.4/mysql.mli 2009-10-16 11:42:08.075507981 +0100 @@ -230,6 +230,7 @@ (** [escape str] returns the same string as [str] in MySQL syntax with special characters quoted to not confuse the MySQL parser *) val escape : string -> string +val real_escape : dbd -> string -> string (** [xxx2ml str] decodes a MySQL value of type xxx into a corresponding OCaml value *) @@ -277,14 +278,18 @@ (** [ml2xxx v] encodes [v] into MySQL syntax. *) val ml2str : string -> string +val ml2rstr : dbd -> string -> string val ml2blob : string -> string +val ml2rblob : dbd -> string -> string val ml2int : int -> string val ml2decimal : string -> string val ml322int : int32 -> string val ml642int : int64 -> string val ml2float : float -> string val ml2enum : string -> string +val ml2renum : dbd -> string -> string val ml2set : string list -> string +val ml2rset : dbd -> string list -> string val ml2datetime : int * int * int * int * int * int -> string val ml2datetimel : year:int -> month:int -> day:int -> hour:int -> min:int -> sec:int -> string val ml2date : int * int * int -> string diff -ur ocaml-mysql-1.0.4.orig/mysql_stubs.c ocaml-mysql-1.0.4/mysql_stubs.c --- ocaml-mysql-1.0.4.orig/mysql_stubs.c 2006-02-23 23:12:36.000000000 +0000 +++ ocaml-mysql-1.0.4/mysql_stubs.c 2009-10-16 11:42:08.076508492 +0100 @@ -472,6 +472,33 @@ CAMLreturn(res); } +EXTERNAL value +db_real_escape(value dbd, value str) +{ + CAMLparam2(dbd, str); + char *s; + char *buf; + int len, esclen; + MYSQL *mysql; + CAMLlocal1(res); + + check_dbd(dbd, "escape"); + mysql = DBDmysql(dbd); + + s = String_val(str); + len = string_length(str); + buf = (char*) stat_alloc(2*len+1); + caml_enter_blocking_section(); + esclen = mysql_real_escape_string(mysql,buf,s,len); + caml_leave_blocking_section(); + + res = alloc_string(esclen); + memcpy(String_val(res), buf, esclen); + stat_free(buf); + + CAMLreturn(res); +} + /* * db_size -- returns the size of the current result (number of rows). */ Index: ocaml-mysql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-mysql/devel/ocaml-mysql.spec,v retrieving revision 1.10 retrieving revision 1.11 diff -u -p -r1.10 -r1.11 --- ocaml-mysql.spec 25 Jul 2009 20:00:13 -0000 1.10 +++ ocaml-mysql.spec 16 Oct 2009 10:43:31 -0000 1.11 @@ -3,7 +3,7 @@ Name: ocaml-mysql Version: 1.0.4 -Release: 10%{?dist} +Release: 11%{?dist} Summary: OCaml library for accessing MySQL databases Group: Development/Libraries @@ -13,6 +13,8 @@ Source0: http://raevnos.pennmush. BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) ExcludeArch: sparc64 s390 s390x +Patch0: ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch + BuildRequires: ocaml >= 3.10.0 BuildRequires: ocaml-findlib-devel BuildRequires: ocaml-ocamldoc @@ -46,6 +48,7 @@ developing applications that use %{name} %prep %setup -q +%patch0 -p1 ./configure --libdir=%{_libdir} @@ -97,6 +100,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.0.4-11 +- Patch for CVE 2009-2942 Missing escape function (RHBZ#529321). + * Sat Jul 25 2009 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.0.4-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

1 0

rpms/ocaml-postgresql/F-11 ocaml-postgresql.spec,1.14,1.15
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/F-11 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12935 Modified Files: ocaml-postgresql.spec Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc11.2 - Fix build process for new upstream tarball layout. Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/ocaml-postgresql.spec,v retrieving revision 1.14 retrieving revision 1.15 diff -u -p -r1.14 -r1.15 --- ocaml-postgresql.spec 16 Oct 2009 10:19:00 -0000 1.14 +++ ocaml-postgresql.spec 16 Oct 2009 10:25:24 -0000 1.15 @@ -3,7 +3,7 @@ Name: ocaml-postgresql Version: 1.12.3 -Release: 1%{?dist} +Release: 1%{?dist}.2 Summary: OCaml library for accessing PostgreSQL databases Group: Development/Libraries @@ -82,7 +82,7 @@ rm -rf $RPM_BUILD_ROOT %files devel %defattr(-,root,root,-) -%doc LICENSE AUTHORS Changes README.txt examples +%doc LICENSE AUTHORS Changelog README.txt examples %if %opt %{_libdir}/ocaml/postgresql/*.a %{_libdir}/ocaml/postgresql/*.cmxa @@ -91,6 +91,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc11.2 +- Fix build process for new upstream tarball layout. + * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for:

1 0

rpms/ocaml-postgresql/F-10 ocaml-postgresql.spec,1.7,1.8
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/F-10 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12703 Modified Files: ocaml-postgresql.spec Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc10.2 - Fix build process for new upstream tarball layout. Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/ocaml-postgresql.spec,v retrieving revision 1.7 retrieving revision 1.8 diff -u -p -r1.7 -r1.8 --- ocaml-postgresql.spec 16 Oct 2009 10:18:58 -0000 1.7 +++ ocaml-postgresql.spec 16 Oct 2009 10:24:21 -0000 1.8 @@ -3,13 +3,13 @@ Name: ocaml-postgresql Version: 1.12.3 -Release: 1%{?dist} +Release: 1%{?dist}.2 Summary: OCaml library for accessing PostreSQL databases Group: Development/Libraries License: LGPLv2+ with exceptions URL: http://www.ocaml.info/home/ocaml_sources.html#toc13 -Source0: http://www.ocaml.info/ocaml_sources/postgresql-ocaml-%{version}.tar.bz2 +Source0: http://hg.ocaml.info/release/postgresql-ocaml/archive/release-%{version}.ta… BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: ocaml >= 3.10.0 @@ -44,7 +44,7 @@ developing applications that use %{name} %prep -%setup -q -n postgresql-ocaml-%{version} +%setup -q -n postgresql-ocaml-release-%{version} %build @@ -82,7 +82,7 @@ rm -rf $RPM_BUILD_ROOT %files devel %defattr(-,root,root,-) -%doc LICENSE AUTHORS Changes README examples +%doc LICENSE AUTHORS Changelog README.txt examples %if %opt %{_libdir}/ocaml/postgresql/*.a %{_libdir}/ocaml/postgresql/*.cmxa @@ -91,6 +91,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc10.2 +- Fix build process for new upstream tarball layout. + * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for:

1 0

rpms/ocaml-postgresql/F-12 .cvsignore, 1.6, 1.7 ocaml-postgresql.spec, 1.16, 1.17 sources, 1.6, 1.7
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/F-12 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11004 Modified Files: .cvsignore ocaml-postgresql.spec sources Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for: https://bugzilla.redhat.com/show_bug.cgi?id=529325 CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) HOWEVER you are not protected until you change your code to use the new connection#escape_string method. Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/.cvsignore,v retrieving revision 1.6 retrieving revision 1.7 diff -u -p -r1.6 -r1.7 --- .cvsignore 23 May 2009 08:12:43 -0000 1.6 +++ .cvsignore 16 Oct 2009 10:19:01 -0000 1.7 @@ -1 +1 @@ -release-1.11.1.tar.bz2 +release-1.12.3.tar.bz2 Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/ocaml-postgresql.spec,v retrieving revision 1.16 retrieving revision 1.17 diff -u -p -r1.16 -r1.17 --- ocaml-postgresql.spec 25 Jul 2009 20:03:37 -0000 1.16 +++ ocaml-postgresql.spec 16 Oct 2009 10:19:01 -0000 1.17 @@ -2,8 +2,8 @@ %define debug_package %{nil} Name: ocaml-postgresql -Version: 1.11.1 -Release: 2%{?dist} +Version: 1.12.3 +Release: 1%{?dist} Summary: OCaml library for accessing PostgreSQL databases Group: Development/Libraries @@ -92,6 +92,14 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 +- New upstream version 1.12.3. +- This contains a SECURITY fix for: + https://bugzilla.redhat.com/show_bug.cgi?id=529325 + CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) + HOWEVER you are not protected until you change your code to + use the new connection#escape_string method. + * Sat Jul 25 2009 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.11.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/sources,v retrieving revision 1.6 retrieving revision 1.7 diff -u -p -r1.6 -r1.7 --- sources 23 May 2009 08:12:43 -0000 1.6 +++ sources 16 Oct 2009 10:19:01 -0000 1.7 @@ -1 +1 @@ -d293714bd15824db031a47d1c42c1f36 release-1.11.1.tar.bz2 +64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2

1 0

rpms/ocaml-postgresql/F-11 .cvsignore, 1.5, 1.6 ocaml-postgresql.spec, 1.13, 1.14 sources, 1.5, 1.6
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/F-11 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11025 Modified Files: .cvsignore ocaml-postgresql.spec sources Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for: https://bugzilla.redhat.com/show_bug.cgi?id=529325 CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) HOWEVER you are not protected until you change your code to use the new connection#escape_string method. Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/.cvsignore,v retrieving revision 1.5 retrieving revision 1.6 diff -u -p -r1.5 -r1.6 --- .cvsignore 10 Mar 2009 14:06:41 -0000 1.5 +++ .cvsignore 16 Oct 2009 10:19:00 -0000 1.6 @@ -1 +1 @@ -release-1.10.3.tar.bz2 +release-1.12.3.tar.bz2 Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/ocaml-postgresql.spec,v retrieving revision 1.13 retrieving revision 1.14 diff -u -p -r1.13 -r1.14 --- ocaml-postgresql.spec 10 Mar 2009 14:06:41 -0000 1.13 +++ ocaml-postgresql.spec 16 Oct 2009 10:19:00 -0000 1.14 @@ -2,7 +2,7 @@ %define debug_package %{nil} Name: ocaml-postgresql -Version: 1.10.3 +Version: 1.12.3 Release: 1%{?dist} Summary: OCaml library for accessing PostgreSQL databases @@ -91,6 +91,14 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 +- New upstream version 1.12.3. +- This contains a SECURITY fix for: + https://bugzilla.redhat.com/show_bug.cgi?id=529325 + CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) + HOWEVER you are not protected until you change your code to + use the new connection#escape_string method. + * Tue Mar 10 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.10.3-1 - New upstream version 1.10.3. - Fix URL. Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/sources,v retrieving revision 1.5 retrieving revision 1.6 diff -u -p -r1.5 -r1.6 --- sources 10 Mar 2009 14:06:41 -0000 1.5 +++ sources 16 Oct 2009 10:19:00 -0000 1.6 @@ -1 +1 @@ -ebac79d610e5be1cfb39b69be2865e5d release-1.10.3.tar.bz2 +64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2

1 0

rpms/ocaml-postgresql/F-10 .cvsignore, 1.3, 1.4 ocaml-postgresql.spec, 1.6, 1.7 sources, 1.3, 1.4
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/F-10 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11044 Modified Files: .cvsignore ocaml-postgresql.spec sources Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for: https://bugzilla.redhat.com/show_bug.cgi?id=529325 CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) HOWEVER you are not protected until you change your code to use the new connection#escape_string method. Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/.cvsignore,v retrieving revision 1.3 retrieving revision 1.4 diff -u -p -r1.3 -r1.4 --- .cvsignore 4 Apr 2008 11:53:16 -0000 1.3 +++ .cvsignore 16 Oct 2009 10:18:58 -0000 1.4 @@ -1 +1 @@ -postgresql-ocaml-1.8.2.tar.bz2 +release-1.12.3.tar.bz2 Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/ocaml-postgresql.spec,v retrieving revision 1.6 retrieving revision 1.7 diff -u -p -r1.6 -r1.7 --- ocaml-postgresql.spec 23 Apr 2008 11:10:18 -0000 1.6 +++ ocaml-postgresql.spec 16 Oct 2009 10:18:58 -0000 1.7 @@ -2,8 +2,8 @@ %define debug_package %{nil} Name: ocaml-postgresql -Version: 1.8.2 -Release: 4%{?dist} +Version: 1.12.3 +Release: 1%{?dist} Summary: OCaml library for accessing PostreSQL databases Group: Development/Libraries @@ -91,6 +91,14 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 +- New upstream version 1.12.3. +- This contains a SECURITY fix for: + https://bugzilla.redhat.com/show_bug.cgi?id=529325 + CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) + HOWEVER you are not protected until you change your code to + use the new connection#escape_string method. + * Wed Apr 23 2008 Richard W.M. Jones <rjones(a)redhat.com> - 1.8.2-4 - Rebuild for OCaml 3.10.2 Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/sources,v retrieving revision 1.3 retrieving revision 1.4 diff -u -p -r1.3 -r1.4 --- sources 4 Apr 2008 11:53:16 -0000 1.3 +++ sources 16 Oct 2009 10:18:58 -0000 1.4 @@ -1 +1 @@ -3ba2746c46e223d82b3ba32835ba6635 postgresql-ocaml-1.8.2.tar.bz2 +64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2

1 0

rpms/ocaml-postgresql/devel .cvsignore, 1.7, 1.8 ocaml-postgresql.spec, 1.17, 1.18 sources, 1.7, 1.8
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-postgresql/devel In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv9553 Modified Files: .cvsignore ocaml-postgresql.spec sources Log Message: * Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 - New upstream version 1.12.3. - This contains a SECURITY fix for: https://bugzilla.redhat.com/show_bug.cgi?id=529325 CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) HOWEVER you are not protected until you change your code to use the new connection#escape_string method. Index: .cvsignore =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/.cvsignore,v retrieving revision 1.7 retrieving revision 1.8 diff -u -p -r1.7 -r1.8 --- .cvsignore 4 Oct 2009 21:03:48 -0000 1.7 +++ .cvsignore 16 Oct 2009 10:14:19 -0000 1.8 @@ -1 +1 @@ -release-1.12.1.tar.bz2 +release-1.12.3.tar.bz2 Index: ocaml-postgresql.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/ocaml-postgresql.spec,v retrieving revision 1.17 retrieving revision 1.18 diff -u -p -r1.17 -r1.18 --- ocaml-postgresql.spec 4 Oct 2009 21:03:49 -0000 1.17 +++ ocaml-postgresql.spec 16 Oct 2009 10:14:19 -0000 1.18 @@ -2,8 +2,8 @@ %define debug_package %{nil} Name: ocaml-postgresql -Version: 1.12.1 -Release: 2%{?dist} +Version: 1.12.3 +Release: 1%{?dist} Summary: OCaml library for accessing PostgreSQL databases Group: Development/Libraries @@ -92,6 +92,14 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1 +- New upstream version 1.12.3. +- This contains a SECURITY fix for: + https://bugzilla.redhat.com/show_bug.cgi?id=529325 + CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1) + HOWEVER you are not protected until you change your code to + use the new connection#escape_string method. + * Sun Oct 4 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.1-1 - New upstream version 1.12.1. Index: sources =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/sources,v retrieving revision 1.7 retrieving revision 1.8 diff -u -p -r1.7 -r1.8 --- sources 4 Oct 2009 21:03:49 -0000 1.7 +++ sources 16 Oct 2009 10:14:19 -0000 1.8 @@ -1 +1 @@ -e912df9259d74c123660072e12335871 release-1.12.1.tar.bz2 +64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2

1 0

[Bug 509531] New: CVE-2009-2295 ocaml-camlimages: PNG reader multiple integer overflows (oCERT-2009-009)
by Red Hat Bugzilla 16 Oct '09

16 Oct '09

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: CVE-2009-2295 ocaml-camlimages: PNG reader multiple integer overflows (oCERT-2009-009) Alias: CVE-2009-2295 https://bugzilla.redhat.com/show_bug.cgi?id=509531 Summary: CVE-2009-2295 ocaml-camlimages: PNG reader multiple integer overflows (oCERT-2009-009) Product: Security Response Version: unspecified Platform: All OS/Version: Linux Status: NEW Keywords: Security Severity: medium Priority: medium Component: vulnerability AssignedTo: security-response-team(a)redhat.com ReportedBy: thoger(a)redhat.com CC: rjones(a)redhat.com, fedora-ocaml-list(a)redhat.com Classification: Other Target Release: --- oCERT advisory oCERT-2009-009 was published describing a flaw in ocaml-camlimages: http://www.ocert.org/advisories/ocert-2009-009.html CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. The vulnerability is triggered by PNG image parsing, the read_png_file and read_png_file_as_rgb24 functions do not properly validate the width and height of the image. Specific PNG images with large width and height can be crafted to trigger the vulnerability. Issue was reported to affect both 2.2 and 3.0.1, which no upstream patch available at the moment. References: http://thread.gmane.org/gmane.comp.security.oss.general/1882 http://bugs.gentoo.org/show_bug.cgi?id=276235 -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 16

rpms/ocaml-camlimages/EL-5 ocaml-camlimages.spec,1.5,1.6
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-camlimages/EL-5 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv30231 Modified Files: ocaml-camlimages.spec Log Message: - Changed dep back to 'lablgtk' so this can build. Index: ocaml-camlimages.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-camlimages/EL-5/ocaml-camlimages.spec,v retrieving revision 1.5 retrieving revision 1.6 diff -u -p -r1.5 -r1.6 --- ocaml-camlimages.spec 16 Oct 2009 09:49:59 -0000 1.5 +++ ocaml-camlimages.spec 16 Oct 2009 09:56:41 -0000 1.6 @@ -1,6 +1,6 @@ Name: ocaml-camlimages Version: 2.2.0 -Release: 11%{?dist} +Release: 12%{?dist} Summary: OCaml image processing library Group: Development/Libraries @@ -18,7 +18,7 @@ Patch2: camlimages-oversized-tif BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) -BuildRequires: ocaml-lablgtk libpng-devel libjpeg-devel ocaml +BuildRequires: lablgtk libpng-devel libjpeg-devel ocaml BuildRequires: libXpm-devel ghostscript-devel freetype-devel BuildRequires: giflib-devel Requires: ocaml @@ -80,9 +80,10 @@ rm -rf $RPM_BUILD_ROOT %changelog -* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-11 +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-12 - ocaml-camlimages: TIFF reader multiple integer overflows (CVE 2009-3296 / RHBZ#528732). +- Changed dep back to 'lablgtk' so this can build. * Fri Jul 3 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-10 - ocaml-camlimages: PNG reader multiple integer overflows

1 0

rpms/ocaml-camlimages/EL-4 ocaml-camlimages.spec,1.4,1.5
by Richard W.M. Jones 16 Oct '09

16 Oct '09

Author: rjones Update of /cvs/pkgs/rpms/ocaml-camlimages/EL-4 In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv6665 Modified Files: ocaml-camlimages.spec Log Message: Force rebuild. Index: ocaml-camlimages.spec =================================================================== RCS file: /cvs/pkgs/rpms/ocaml-camlimages/EL-4/ocaml-camlimages.spec,v retrieving revision 1.4 retrieving revision 1.5 diff -u -p -r1.4 -r1.5 --- ocaml-camlimages.spec 16 Oct 2009 09:51:57 -0000 1.4 +++ ocaml-camlimages.spec 16 Oct 2009 09:52:23 -0000 1.5 @@ -1,6 +1,6 @@ Name: ocaml-camlimages Version: 2.2.0 -Release: 9%{?dist} +Release: 10%{?dist} Summary: OCaml image processing library Group: Development/Libraries @@ -83,7 +83,7 @@ rm -rf $RPM_BUILD_ROOT %changelog -* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-9 +* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-10 - ocaml-camlimages: TIFF reader multiple integer overflows (CVE 2009-3296 / RHBZ#528732).

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

Ocaml-devel October 2009