sm-commit AT lists.ibiblio.org
Subject: Source Mage code commit list
List archive
[SM-Commit] GIT changes to stable-0.61 grimoire by Vlad Glagolev (1008a4d4bf8d93092b217c7c21e426847280424a)
- From: Vlad Glagolev <scm AT sourcemage.org>
- To: sm-commit AT lists.ibiblio.org
- Subject: [SM-Commit] GIT changes to stable-0.61 grimoire by Vlad Glagolev (1008a4d4bf8d93092b217c7c21e426847280424a)
- Date: Thu, 6 Dec 2012 19:25:55 -0600
GIT changes to stable-0.61 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:
VERSION | 2
audio-soft/sox/HISTORY | 3
audio-soft/sox/PRE_BUILD | 7
crypto/libssh/DETAILS | 19 -
crypto/libssh/HISTORY | 5
database/firebird25/DETAILS | 5
database/firebird25/HISTORY | 12
database/firebird25/fb25.patch.bz2 |binary
database/firebird25/init.d/firebird2 | 2
database/mariadb/DETAILS | 6
database/mariadb/HISTORY | 3
kernels/linux/HISTORY | 17 +
kernels/linux/info/patches/maintenance_patches_3/patch-3.0.53 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.0.54 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.0.55 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.2.35 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.4.20 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.4.21 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.4.22 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.6.8 | 5
kernels/linux/info/patches/maintenance_patches_3/patch-3.6.9 | 5
kernels/linux/latest.defaults | 2
libs/lockdev/BUILD | 2
libs/lockdev/DETAILS | 1
libs/lockdev/HISTORY | 4
libs/lockdev/INSTALL | 3
net/bind-tools/DETAILS | 4
net/bind-tools/HISTORY | 3
net/bind/DETAILS | 4
net/bind/HISTORY | 3
net/tor/DETAILS | 4
net/tor/HISTORY | 3
security/wireshark/DETAILS | 6
security/wireshark/HISTORY | 3
utils/xen/DETAILS | 2
utils/xen/HISTORY | 8
utils/xen/PRE_BUILD | 11
utils/xen/xsa-12.patch | 22 +
utils/xen/xsa-13.patch | 30 +
utils/xen/xsa-14.patch | 22 +
utils/xen/xsa-16.patch | 31 +
utils/xen/xsa-17.patch | 113 ++++++
utils/xen/xsa-26.patch | 107 ++++++
utils/xen/xsa-27.patch | 168
++++++++++
utils/xen/xsa-28.patch | 36 ++
utils/xen/xsa-29.patch | 49 ++
utils/xen/xsa-30.patch | 57 +++
utils/xen/xsa-31.patch | 50 ++
48 files changed, 843 insertions(+), 31 deletions(-)
New commits:
commit 1008a4d4bf8d93092b217c7c21e426847280424a
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
VERSION: 0.61-15
commit f8d4c983296825e0ac5778a229cce9dc12d14b41
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
bind-tools: => 9.9.2-P1 (security)
(cherry picked from commit e59d9f790933c133621d604bbb29cbfea890a3c6)
commit c64018cff78240ef777a30159dd70df718840ce7
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
bind: => 9.8.4-P1 (security)
(cherry picked from commit 6c5b259fdace0f8a70c896153582ee79109b11bd)
commit 38ebe03c3c537aa7455d41e6335c3439e111a8b7
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
tor: => 0.2.3.25 (security)
(cherry picked from commit 0f17afe9fbb2569d8bb3c02035f1353f774d0024)
commit 3930758d6a9f1079357eb6a48b70fabc27cb3cfd
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
xen: security update
(cherry picked from commit c00291a5bee6e4b5cc89a008f7cc34c9e3148f74)
commit f75327600f5b05da57bc48cf67506d1ebce36755
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
xen: SECURITY_PATCH++ for real
(cherry picked from commit b52333c40bf43ec491eb432c2986511c2c80cd0b)
commit 3d681c8949e2c7c4776a808e819d6c226769cc33
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
xen: security update
(cherry picked from commit ef51862533d5b2b8aa63e2f27d35aaca20630bac)
commit c9a839d449aadfb4eaee5fbc8c942e85cd6e02b8
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux: => 3.4.22 (lts)
(cherry picked from commit 1ff7ccff1347f6f1228c9644f8193e52aa8e1a4c)
commit 6c5a637f7f7ed8ce78d55ed22eddb78bbbb952d9
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux: => 3.2.35 (lts)
(cherry picked from commit 7e7b598fd7f1c3dbb38c1bcb803c079802f0da7f)
commit 80f307dc2e570ec69498141a5e5d5bd43e093ef2
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux: => 3.0.55 (lts)
(cherry picked from commit 274863411cd4a23ff97fc3a48e9dabef77d7584e)
commit 2f727a94934786c0616a6eb8ec0c9a50486a0bdf
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux 3.6.9
(cherry picked from commit bf2f5c9f04b6b123660700fe3f5af58f2d97af61)
commit 18fdc47d5f63dfa8f93f5e562952b326beebee97
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
mariadb: => 5.2.13 (security)
(cherry picked from commit 5fe7421b57338515d2443a78cc3d4e9d76a4d3b2)
commit 4e05cda0845c53ed12e5005f84b980422af037a2
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
wireshark 1.8.4, SECURITY_PATCH=40
(cherry picked from commit f2a97616dad552921222ac99d1c16b04ce1e2700)
commit beda5bfa7cd36b34253e0fa23dbf92408d0c8bbc
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux: => 3.4.20 (lts)
(cherry picked from commit efbd9c89b751e0698df733e12551e0d4a9d8327a)
commit 9f3c4e8446e5a309ef0bd92f99818151754b158f
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux: => 3.0.53 (lts)
(cherry picked from commit 0ed16e7bbbf72d2673277f09a5ec1dddd3889f8a)
commit 05f21be708aee9ba4dfc63582d68161e7062785a
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
libssh: => 0.5.3 security fix
(cherry picked from commit 7db1c7f4f3c8e456e50ce7a9275f9229e7b6c24c)
commit b5593bed285a115d04e5a3dce53ae807f9922eb9
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
lockdev - create a symlink for liblockdev.so
(cherry picked from commit 49e69af25267c50bf338c087e44cd871d7b11555)
commit 93993b9d4436e694de53db425a0c5dbf123d8b95
Author: Ladislav Hagara <hgr AT vabo.cz>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
linux 3.6.8
(cherry picked from commit ab8a60be0936e625e880308ee5dd458502748682)
commit 98fae6b607ddf753ee2f9b5e2b3bb6992e688d42
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
firebird25 - fixes CVE-2012-5529
(cherry picked from commit 016b2d68d15a43980e5d8bae5975cd8eb0024941)
commit fac3512a8428f12cc589eb6e4ece1153b4664e17
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
firebird25 - tweak init script
(cherry picked from commit b537358e7d791bb8e8649508aba84be02127db3f)
commit 106a512f990bb73cd067ee20fbbfeffc88d8383c
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
firebird25: => 2.5.2.26539-0
(cherry picked from commit 48ce9123de4396ca6433e2db13748d57e8f20d5d)
commit d4bb841e26f94729114ed884c93b28e8d8f9ff78
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>
sox: apply ffmpeg 0.11 patch only for ffmpeg >=0.11
(cherry picked from commit 1a241b6c35147b1f1b7b89132b92314b62297064)
diff --git a/VERSION b/VERSION
index e66e2b4..0d6100f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.61-14
+0.61-15
diff --git a/audio-soft/sox/HISTORY b/audio-soft/sox/HISTORY
index f77f9c2..89152db 100644
--- a/audio-soft/sox/HISTORY
+++ b/audio-soft/sox/HISTORY
@@ -1,3 +1,6 @@
+2012-11-25 Vlad Glagolev <stealth AT sourcemage.org>
+ * PRE_BUILD: apply ffmpeg 0.11 patch only for ffmpeg >=0.11
+
2012-06-20 Arjan Bouter <abouter AT sourcemage.org>
* ffmpeg-0.11-arch.patch: added patch from arch to fix
building against ffmpeg 0.11
diff --git a/audio-soft/sox/PRE_BUILD b/audio-soft/sox/PRE_BUILD
index af4ad33..bc5bec1 100755
--- a/audio-soft/sox/PRE_BUILD
+++ b/audio-soft/sox/PRE_BUILD
@@ -1,5 +1,10 @@
+. "$GRIMOIRE/FUNCTIONS" &&
+
default_pre_build &&
cd "$SOURCE_DIRECTORY" &&
patch -p0 < "$SPELL_DIRECTORY/file-5.0.patch" &&
-patch -p1 < "${SPELL_DIRECTORY}/ffmpeg-0.11-arch.patch"
+
+if spell_ok ffmpeg && is_version_less 0.10 $(installed_version ffmpeg); then
+ patch -p1 < "${SPELL_DIRECTORY}/ffmpeg-0.11-arch.patch"
+fi
diff --git a/crypto/libssh/DETAILS b/crypto/libssh/DETAILS
index 630e640..54f57f6 100755
--- a/crypto/libssh/DETAILS
+++ b/crypto/libssh/DETAILS
@@ -1,19 +1,18 @@
SPELL=libssh
- VERSION=0.5.2
- SECURITY_PATCH=1
+ VERSION=0.5.3
+
SOURCE_HASH=sha512:67cc023a9c5f7da02af378e9be14b720a81074dfff3a9115a061925ba2244a7f508e122c10b229dc831fc8015e3d58616284f3c46d7060721d61d49a3ca94d7e
+ SECURITY_PATCH=2
SOURCE=$SPELL-$VERSION.tar.gz
- SOURCE2=$SOURCE.asc
+# SOURCE2=$SOURCE.asc
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
- SOURCE_URL[0]=https://red.libssh.org/attachments/download/27/$SOURCE
- SOURCE2_URL[0]=https://red.libssh.org/attachments/download/29/$SOURCE2
+ SOURCE_URL[0]=https://red.libssh.org/attachments/download/38/$SOURCE
+# SOURCE2_URL[0]=https://red.libssh.org/attachments/download/37/$SOURCE2
SOURCE_HINTS[0]="no-check-certificate"
-SOURCE2_HINTS[0]="no-check-certificate"
-# SOURCE_URL[0]=http://www.libssh.org/files/${VERSION::3}/$SOURCE
-# SOURCE2_URL[0]=${SOURCE_URL[0]}.asc
+#SOURCE2_HINTS[0]="no-check-certificate"
WEB_SITE=http://www.libssh.org/
ENTERED=20041208
- SOURCE_GPG=F33E3FC6.gpg:$SOURCE2:UPSTREAM_KEY
- SOURCE2_IGNORE=signature
+# SOURCE_GPG=F33E3FC6.gpg:$SOURCE2:UPSTREAM_KEY
+# SOURCE2_IGNORE=signature
LICENSE[0]=GPL
KEYWORDS="ssh crypto"
SHORT="a library for accessing ssh client services through C
libraries calls."
diff --git a/crypto/libssh/HISTORY b/crypto/libssh/HISTORY
index 57925fd..d9575e6 100644
--- a/crypto/libssh/HISTORY
+++ b/crypto/libssh/HISTORY
@@ -1,3 +1,8 @@
+2012-11-30 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 0.5.3
+ SECURITY_PATCH++
+ fixes CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562
+
2011-09-17 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 0.5.2, SOURCE_URLs updated, SOURCE_HINTSs added
diff --git a/database/firebird25/DETAILS b/database/firebird25/DETAILS
index b43b4e5..614a8f0 100755
--- a/database/firebird25/DETAILS
+++ b/database/firebird25/DETAILS
@@ -1,7 +1,8 @@
SPELL=firebird25
SPELLX=Firebird
- VERSION=2.5.0.26074-0
-
SOURCE_HASH=sha512:0894b998ddfc6daaea9df25c4b912e27797284ed39cefee20f72e994196587655a76267fceaed24437e24cab04db797fcf50e7505c8ef9e87b3c45b57a155cd8
+ VERSION=2.5.2.26539-0
+
SOURCE_HASH=sha512:f3b3a8ec35202620bd6b35d5b1004a0d668b8d1a0a7c0864b40b9a7fb682e8b0d0f7b68fbbdc1ee8ace4602f1756103798a1ed8f4b8b14dfa921e06b81c10e8b
+ SECURITY_PATCH=1
SOURCE_DIRECTORY=$BUILD_DIRECTORY/${SPELLX}-${VERSION/-0\.RC?/}
SOURCE=${SPELLX}-$VERSION.tar.bz2
SOURCE_URL[0]=http://firebirdsql.org/download/prerelease/source/$SOURCE
diff --git a/database/firebird25/HISTORY b/database/firebird25/HISTORY
index 58e1544..6842538 100644
--- a/database/firebird25/HISTORY
+++ b/database/firebird25/HISTORY
@@ -1,3 +1,15 @@
+2012-11-26 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH=1
+ fixes CVE-2012-5529
+ TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled,
+ allows remote authenticated users to cause a denial of service (NULL
+ pointer dereference and crash) by preparing an empty dynamic SQL
query
+
+2012-11-08 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: version 2.5.2.26539-0
+ * fb25.patch: remove some patches
+ * init.d/firebird2: minor tweak for recent bash
+
2011-12-13 Treeve Jelbert <treeve AT sourcemage.org>
* DEPENDS: add optional libatomic_ops
diff --git a/database/firebird25/fb25.patch.bz2
b/database/firebird25/fb25.patch.bz2
index 68685c1..8fcc2c0 100644
Binary files a/database/firebird25/fb25.patch.bz2 and
b/database/firebird25/fb25.patch.bz2 differ
diff --git a/database/firebird25/init.d/firebird2
b/database/firebird25/init.d/firebird2
index e68436e..bac2eef 100755
--- a/database/firebird25/init.d/firebird2
+++ b/database/firebird25/init.d/firebird2
@@ -23,7 +23,7 @@ NEEDS="+network +remote_fs"
case $1 in
start)
echo "Starting Firebird Super Server"
- su -s "/bin/sh" -m -c "$FB_DIR/$FB" -l "firebird" &
+ su -s "/bin/sh" -c "$FB_DIR/$FB" -l "firebird" &
evaluate_retval
;;
stop)
diff --git a/database/mariadb/DETAILS b/database/mariadb/DETAILS
index 9261999..97a0b18 100755
--- a/database/mariadb/DETAILS
+++ b/database/mariadb/DETAILS
@@ -1,9 +1,9 @@
SPELL=mariadb
- VERSION=5.2.12
- SECURITY_PATCH=1
+ VERSION=5.2.13
+ SECURITY_PATCH=2
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
-
SOURCE_HASH=sha512:d4583e0f6b8ae5b90e6c2818ecb98eadd5245e1c2c1a270980dc7b002c62f056fe0c15a389548d6e0ec3c0d83ac72a9fe30b6f9b220c92eae0e0ca29fd7bb333
+
SOURCE_HASH=sha512:696bb5f59f25fa31fc35399c99f6f13e37a178b1e9b0155e3cf053b1232a950035132d075b0594ff611f6b59635d49d0800820c2bbd02932d16917e174717f8a
SOURCE_URL[0]=http://mirrors.fe.up.pt/pub/$SPELL/$SPELL-$VERSION/kvm-tarbake-jaunty-x86/$SOURCE
SOURCE_URL[1]=http://ftp-stud.hs-esslingen.de/pub/Mirrors/$SPELL/$SPELL-$VERSION/kvm-tarbake-jaunty-x86/$SOURCE
SOURCE_URL[2]=http://ftp.osuosl.org/pub/$SPELL/$SPELL-$VERSION/kvm-tarbake-jaunty-x86/$SOURCE
diff --git a/database/mariadb/HISTORY b/database/mariadb/HISTORY
index 63d39d3..652b119 100644
--- a/database/mariadb/HISTORY
+++ b/database/mariadb/HISTORY
@@ -1,3 +1,6 @@
+2012-12-03 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 5.2.13; SECURITY_PATCH++ (CVE-2012-5579)
+
2012-06-10 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 5.2.12; SECURITY_PATCH=1 (CVE-2012-2122)
* DEPENDS: disabled system readline support
diff --git a/kernels/linux/HISTORY b/kernels/linux/HISTORY
index 0437720..b2c424c 100644
--- a/kernels/linux/HISTORY
+++ b/kernels/linux/HISTORY
@@ -1,3 +1,20 @@
+2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * info/patches/maintenance_patches_3/patch-3.0.{54,55}: added
+ * info/patches/maintenance_patches_3/patch-3.2.35: added
+ * info/patches/maintenance_patches_3/patch-3.4.{21,22}: added
+
+2012-12-04 Ladislav Hagara <hgr AT vabo.cz>
+ * latest.defaults: LATEST_maintenance_patches_3=patch-3.6.9
+ * info/patches/maintenance_patches_3/patch-3.6.9: added
+
+2012-12-02 Vlad Glagolev <stealth AT sourcemage.org>
+ * info/patches/maintenance_patches_3/patch-3.0.53: added
+ * info/patches/maintenance_patches_3/patch-3.4.20: added
+
+2012-11-27 Ladislav Hagara <hgr AT vabo.cz>
+ * latest.defaults: LATEST_maintenance_patches_3=patch-3.6.8
+ * info/patches/maintenance_patches_3/patch-3.6.8: added
+
2012-11-23 Vlad Glagolev <stealth AT sourcemage.org>
* info/patches/maintenance_patches_3/patch-3.4.19: added
* info/patches/maintenance_patches_3/patch-3.0.52: added
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.53
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.53
new file mode 100755
index 0000000..dcde558
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.53
@@ -0,0 +1,5 @@
+appliedkernels="3.0"
+patchversion="${appliedkernels}.53"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.0/${source}"
+sha1sum="f9dc53159955cf8748a41dbb009cc16eba0f665b"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.54
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.54
new file mode 100755
index 0000000..676d281
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.54
@@ -0,0 +1,5 @@
+appliedkernels="3.0"
+patchversion="${appliedkernels}.54"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.0/${source}"
+sha1sum="89634684fc9f80cdf51581f8b825ff7591499c27"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.55
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.55
new file mode 100755
index 0000000..dc1a504
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.0.55
@@ -0,0 +1,5 @@
+appliedkernels="3.0"
+patchversion="${appliedkernels}.55"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.0/${source}"
+sha1sum="8fbba82f4c9bb10e09c47d134adb0487a83940de"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.35
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.35
new file mode 100755
index 0000000..78d4bfe
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.2.35
@@ -0,0 +1,5 @@
+appliedkernels="3.2"
+patchversion="${appliedkernels}.35"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="4b94f132f7896ff5d1a794eda5276c618cea0eac"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.20
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.20
new file mode 100755
index 0000000..4e2846b
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.20
@@ -0,0 +1,5 @@
+appliedkernels="3.4"
+patchversion="${appliedkernels}.20"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="49ccd1045759aa6c40bfa06b04183bf0323a46c7"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.21
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.21
new file mode 100755
index 0000000..e22f725
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.21
@@ -0,0 +1,5 @@
+appliedkernels="3.4"
+patchversion="${appliedkernels}.21"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="d6f8e3326c472fa929319b528050c314a3562414"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.22
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.22
new file mode 100755
index 0000000..74645ba
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.4.22
@@ -0,0 +1,5 @@
+appliedkernels="3.4"
+patchversion="${appliedkernels}.22"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="4a57d2399c4cb1847ccfe78f44cbabe8e28d929a"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.8
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.8
new file mode 100755
index 0000000..4bf9d49
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.8
@@ -0,0 +1,5 @@
+appliedkernels="3.6"
+patchversion="${appliedkernels}.8"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="be12bba4502ea0a20f38ed5c87d04048a69723cb"
diff --git a/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.9
b/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.9
new file mode 100755
index 0000000..c348b94
--- /dev/null
+++ b/kernels/linux/info/patches/maintenance_patches_3/patch-3.6.9
@@ -0,0 +1,5 @@
+appliedkernels="3.6"
+patchversion="${appliedkernels}.9"
+source="patch-${patchversion}.bz2"
+source_url="${KERNEL_URL}/pub/linux/kernel/v3.x/${source}"
+sha1sum="90f17ccadd54257d261a003c8da27e8b2813eee8"
diff --git a/kernels/linux/latest.defaults b/kernels/linux/latest.defaults
index b666dd7..619876f 100644
--- a/kernels/linux/latest.defaults
+++ b/kernels/linux/latest.defaults
@@ -2,7 +2,7 @@ LATEST_3=3.6
LATEST_2_6=2.6.39
LATEST_PRE_2_6=patch-2.6.39
LATEST_maintenance_patches=patch-2.6.39.4
-LATEST_maintenance_patches_3=patch-3.6.7
+LATEST_maintenance_patches_3=patch-3.6.9
LATEST_git_patches=patch-2.6.25-rc6-git7
LATEST_2_4=2.4.37.9
LATEST_PRE_2_4=patch-2.4.33-pre1
diff --git a/libs/lockdev/BUILD b/libs/lockdev/BUILD
index 51764b6..6dccbc0 100755
--- a/libs/lockdev/BUILD
+++ b/libs/lockdev/BUILD
@@ -1 +1 @@
-make basedir=$INSTALL_ROOT/usr/
+make basedir=$INSTALL_ROOT/usr
diff --git a/libs/lockdev/DETAILS b/libs/lockdev/DETAILS
index b62430b..fd37795 100755
--- a/libs/lockdev/DETAILS
+++ b/libs/lockdev/DETAILS
@@ -1,5 +1,6 @@
SPELL=lockdev
VERSION=1.0.3
+ PATCHLEVEL=1
SOURCE=${SPELL}_$VERSION.orig.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=http://ftp.de.debian.org/debian/pool/main/l/$SPELL/$SOURCE
diff --git a/libs/lockdev/HISTORY b/libs/lockdev/HISTORY
index 2f2035c..a6f9919 100644
--- a/libs/lockdev/HISTORY
+++ b/libs/lockdev/HISTORY
@@ -1,3 +1,7 @@
+2012-11-27 Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: PATCHLEVEL=1
+ * INSTALL: create a symlink
+
2008-04-12 Eric Sandall <sandalle AT sourcemage.org>
* DETAILS, DEPENDS, PRE_BUILD, BUILD, INSTALL: Created
diff --git a/libs/lockdev/INSTALL b/libs/lockdev/INSTALL
index 7920830..b4129e9 100755
--- a/libs/lockdev/INSTALL
+++ b/libs/lockdev/INSTALL
@@ -1 +1,2 @@
-make basedir=$INSTALL_ROOT/usr/ install
+make basedir=$INSTALL_ROOT/usr install &&
+ln -sf $TRACK_ROOT/usr/lib/liblockdev.1.0.3.so
$INSTALL_ROOT/usr/lib/liblockdev.so
diff --git a/net/bind-tools/DETAILS b/net/bind-tools/DETAILS
index 07145c7..69c6cbc 100755
--- a/net/bind-tools/DETAILS
+++ b/net/bind-tools/DETAILS
@@ -1,12 +1,12 @@
SPELL=bind-tools
- VERSION=9.9.1-P4
+ VERSION=9.9.2-P1
SOURCE=bind-$VERSION.tar.gz
SOURCE2=$SOURCE.sha512.asc
SOURCE_DIRECTORY="$BUILD_DIRECTORY/bind-$VERSION"
SOURCE_URL[0]=ftp://ftp.isc.org/isc/bind9/$VERSION/$SOURCE
SOURCE2_URL[0]=ftp://ftp.isc.org/isc/bind9/$VERSION/$SOURCE2
SOURCE2_IGNORE=signature
- SECURITY_PATCH=11
+ SECURITY_PATCH=12
SOURCE_GPG=isc.gpg:$SOURCE2:UPSTREAM_KEY
LICENSE[0]=ISC
KEYWORDS="net"
diff --git a/net/bind-tools/HISTORY b/net/bind-tools/HISTORY
index f064c2d..9941e6d 100644
--- a/net/bind-tools/HISTORY
+++ b/net/bind-tools/HISTORY
@@ -1,3 +1,6 @@
+2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 9.9.2-P1; SECURITY_PATCH++
+
2012-10-10 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 9.9.1-P4; SECURITY_PATCH++
diff --git a/net/bind/DETAILS b/net/bind/DETAILS
index f2b41d3..4c32fae 100755
--- a/net/bind/DETAILS
+++ b/net/bind/DETAILS
@@ -1,5 +1,5 @@
SPELL=bind
- VERSION=9.8.3-P3
+ VERSION=9.8.4-P1
SOURCE=$SPELL-${VERSION}.tar.gz
SOURCE2=root.zone.gz
SOURCE2_IGNORE=unversioned
@@ -10,7 +10,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-${VERSION}
SOURCE2_URL[0]=ftp://ftp.internic.net/domain/$SOURCE2
SOURCE3_URL[0]=ftp://ftp.isc.org/isc/bind9/$VERSION/$SOURCE3
SOURCE3_IGNORE=signature
- SECURITY_PATCH=7
+ SECURITY_PATCH=8
SOURCE_GPG="isc.gpg:$SOURCE3:UPSTREAM_KEY"
FORCE_DOWNLOAD[2]=true
LICENSE[0]=ISC
diff --git a/net/bind/HISTORY b/net/bind/HISTORY
index 40b5e80..8333caf 100644
--- a/net/bind/HISTORY
+++ b/net/bind/HISTORY
@@ -1,3 +1,6 @@
+2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 9.8.4-P1; SECURITY_PATCH++
+
2012-09-13 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 9.8.3-P3; SECURITY_PATCH++
diff --git a/net/tor/DETAILS b/net/tor/DETAILS
index a916281..76de97c 100755
--- a/net/tor/DETAILS
+++ b/net/tor/DETAILS
@@ -4,8 +4,8 @@ if [ "$TOR_DEVEL" == "y" ]; then
VERSION=0.2.2.23-alpha
SECURITY_PATCH=4
else
- VERSION=0.2.2.39
- SECURITY_PATCH=9
+ VERSION=0.2.3.25
+ SECURITY_PATCH=10
fi
SOURCE=$SPELL-$VERSION.tar.gz
diff --git a/net/tor/HISTORY b/net/tor/HISTORY
index adebcc8..22c0dc4 100644
--- a/net/tor/HISTORY
+++ b/net/tor/HISTORY
@@ -1,3 +1,6 @@
+2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 0.2.3.25; SECURITY_PATCH++ (CVE-2012-5573)
+
2012-09-12 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 0.2.2.39; SECURITY_PATCH++; restored
original source url
diff --git a/security/wireshark/DETAILS b/security/wireshark/DETAILS
index a3070c4..18be552 100755
--- a/security/wireshark/DETAILS
+++ b/security/wireshark/DETAILS
@@ -1,11 +1,11 @@
SPELL=wireshark
- VERSION=1.8.3
- SECURITY_PATCH=39
+ VERSION=1.8.4
+ SECURITY_PATCH=40
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
SOURCE_URL[0]=$SOURCEFORGE_URL/$SPELL/$SOURCE
SOURCE_URL[1]=http://www.wireshark.org/download/src/$SOURCE
-
SOURCE_HASH=sha512:acc6a6fcbf86f67d3d5cb9cfbe4eed3699465f4687c2eca88fa51b417b3bbb68e80630ae5ace814e1a5dfd6f269b286237e4dcaafe510eb4ce87bde044413504
+
SOURCE_HASH=sha512:4f0b7fd181eb74c5eb03e4b5e74546f9f02aa3d481faed2b08a84d98f4a61d808a86e5348046d66f8333ba8f8921db344c2187a1590117ae4bdc2ff85a96d305
WEB_SITE=http://www.wireshark.org/
ENTERED=20020116
LICENSE[0]=GPL
diff --git a/security/wireshark/HISTORY b/security/wireshark/HISTORY
index 6ee662e..36513f9 100644
--- a/security/wireshark/HISTORY
+++ b/security/wireshark/HISTORY
@@ -1,3 +1,6 @@
+2012-12-02 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 1.8.4, SECURITY_PATCH=40
+
2012-10-02 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 1.8.3, SECURITY_PATCH=39
diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index b6a56f2..8ce05b5 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,6 +1,6 @@
SPELL=xen
VERSION=4.1.3
- SECURITY_PATCH=3
+ SECURITY_PATCH=5
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index 72ba730..6d6300b 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,3 +1,11 @@
+2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH+=2
+ * PRE_BUILD: apply patches
+ * xsa-{12-14,16-17,26-31}.patch: added, to fix CVE-2012-3494,
+ CVE-2012-3495, CVE-2012-3496, CVE-2012-3498, CVE-2012-3515,
+ CVE-2012-5510, CVE-2012-5511, CVE-2012-5512, CVE-2012-5513,
+ CVE-2012-5514, CVE-2012-5515
+
2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++
* PRE_BUILD: apply patches
diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index ec73184..c738dc4 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -1,6 +1,11 @@
default_pre_build &&
cd ${SOURCE_DIRECTORY} &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-12.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-13.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-14.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-16.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-17.patch" &&
patch -p0 < "$SPELL_DIRECTORY/xsa-19.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-20.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-21.patch" &&
@@ -8,6 +13,12 @@ patch -p1 < "$SPELL_DIRECTORY/xsa-22.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-23.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-24.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-25.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-26.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-27.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-28.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-29.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-30.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-31.patch" &&
if [[ $XEN_UPINIT != y ]]; then
sedit "s:all install-initd:all:" tools/hotplug/Linux/Makefile
diff --git a/utils/xen/xsa-12.patch b/utils/xen/xsa-12.patch
new file mode 100644
index 0000000..271c4d8
--- /dev/null
+++ b/utils/xen/xsa-12.patch
@@ -0,0 +1,22 @@
+xen: prevent a 64 bit guest setting reserved bits in DR7
+
+The upper 32 bits of this register are reserved and should be written as
+zero.
+
+This is XSA-12 / CVE-2012-3494
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 353bc0801b11 xen/include/asm-x86/debugreg.h
+--- a/xen/include/asm-x86/debugreg.h Mon Aug 06 12:28:03 2012 +0100
++++ b/xen/include/asm-x86/debugreg.h Wed Aug 15 12:00:21 2012 +0100
+@@ -58,7 +58,7 @@
+ We can slow the instruction pipeline for instructions coming via the
+ gdt or the ldt if we want to. I am not sure why this is an advantage */
+
+-#define DR_CONTROL_RESERVED_ZERO (0x0000d800ul) /* Reserved, read as zero */
++#define DR_CONTROL_RESERVED_ZERO (~0xffff27fful) /* Reserved, read as zero
*/
+ #define DR_CONTROL_RESERVED_ONE (0x00000400ul) /* Reserved, read as one */
+ #define DR_LOCAL_EXACT_ENABLE (0x00000100ul) /* Local exact enable */
+ #define DR_GLOBAL_EXACT_ENABLE (0x00000200ul) /* Global exact enable */
diff --git a/utils/xen/xsa-13.patch b/utils/xen/xsa-13.patch
new file mode 100644
index 0000000..35c4715
--- /dev/null
+++ b/utils/xen/xsa-13.patch
@@ -0,0 +1,30 @@
+xen: handle out-of-pirq condition correctly in PHYSDEVOP_get_free_pirq
+
+This is XSA-13 / CVE-2012-3495
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+Signed-off-by: Jan Beulich <JBeulich AT suse.com>
+
+diff -r 1225aff05dd2 xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
++++ b/xen/arch/x86/physdev.c Thu Aug 16 11:07:36 2012 +0100
+@@ -587,11 +587,16 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
+ break;
+
+ spin_lock(&d->event_lock);
+- out.pirq = get_free_pirq(d, out.type, 0);
+- d->arch.pirq_irq[out.pirq] = PIRQ_ALLOCATED;
++ ret = get_free_pirq(d, out.type, 0);
++ if ( ret >= 0 )
++ d->arch.pirq_irq[ret] = PIRQ_ALLOCATED;
+ spin_unlock(&d->event_lock);
+
+- ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
++ if ( ret >= 0 )
++ {
++ out.pirq = ret;
++ ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
++ }
+
+ rcu_unlock_domain(d);
+ break;
diff --git a/utils/xen/xsa-14.patch b/utils/xen/xsa-14.patch
new file mode 100644
index 0000000..cd185b3
--- /dev/null
+++ b/utils/xen/xsa-14.patch
@@ -0,0 +1,22 @@
+xen: Don't BUG_ON() PoD operations on a non-translated guest.
+
+This is XSA-14 / CVE-2012-3496
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
+Tested-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 6779ddca8593 -r 8ebda5388e4e xen/arch/x86/mm/p2m.c
+--- a/xen/arch/x86/mm/p2m.c Wed Sep 05 12:28:17 2012 +0100
++++ b/xen/arch/x86/mm/p2m.c Wed Sep 05 12:29:05 2012 +0100
+@@ -2414,7 +2414,8 @@ guest_physmap_mark_populate_on_demand(st
+ int pod_count = 0;
+ int rc = 0;
+
+- BUG_ON(!paging_mode_translate(d));
++ if ( !paging_mode_translate(d) )
++ return -EINVAL;
+
+ rc = gfn_check_limit(d, gfn, order);
+ if ( rc != 0 )
+
diff --git a/utils/xen/xsa-16.patch b/utils/xen/xsa-16.patch
new file mode 100644
index 0000000..d9662d8
--- /dev/null
+++ b/utils/xen/xsa-16.patch
@@ -0,0 +1,31 @@
+x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI
+
+This is being used as a array index, and hence must be validated before
+use.
+
+This is XSA-16 / CVE-2012-3498.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+
+diff -r 1225aff05dd2 xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
++++ b/xen/arch/x86/physdev.c Thu Aug 16 13:03:36 2012 +0100
+@@ -40,11 +40,18 @@ static int physdev_hvm_map_pirq(
+ struct hvm_girq_dpci_mapping *girq;
+ uint32_t machine_gsi = 0;
+
++ if ( map->index < 0 || map->index >= NR_HVM_IRQS )
++ {
++ ret = -EINVAL;
++ break;
++ }
++
+ /* find the machine gsi corresponding to the
+ * emulated gsi */
+ hvm_irq_dpci = domain_get_irq_dpci(d);
+ if ( hvm_irq_dpci )
+ {
++ BUILD_BUG_ON(ARRAY_SIZE(hvm_irq_dpci->girq) < NR_HVM_IRQS);
+ list_for_each_entry ( girq,
+ &hvm_irq_dpci->girq[map->index],
+ list )
diff --git a/utils/xen/xsa-17.patch b/utils/xen/xsa-17.patch
new file mode 100644
index 0000000..9aa28e0
--- /dev/null
+++ b/utils/xen/xsa-17.patch
@@ -0,0 +1,113 @@
+console: bounds check whenever changing the cursor due to an escape code
+
+This is XSA-17 / CVE-2012-3515
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff --git a/console.c b/console.c
+index 5e6e3d0..9984d6f 100644
+--- a/tools/ioemu-qemu-xen/console.c
++++ b/tools/ioemu-qemu-xen/console.c
+@@ -794,6 +794,26 @@ static void console_clear_xy(TextConsole *s, int x, int
y)
+ update_xy(s, x, y);
+ }
+
++/* set cursor, checking bounds */
++static void set_cursor(TextConsole *s, int x, int y)
++{
++ if (x < 0) {
++ x = 0;
++ }
++ if (y < 0) {
++ y = 0;
++ }
++ if (y >= s->height) {
++ y = s->height - 1;
++ }
++ if (x >= s->width) {
++ x = s->width - 1;
++ }
++
++ s->x = x;
++ s->y = y;
++}
++
+ static void console_putchar(TextConsole *s, int ch)
+ {
+ TextCell *c;
+@@ -869,7 +889,8 @@ static void console_putchar(TextConsole *s, int ch)
+ s->esc_params[s->nb_esc_params] * 10 + ch - '0';
+ }
+ } else {
+- s->nb_esc_params++;
++ if (s->nb_esc_params < MAX_ESC_PARAMS)
++ s->nb_esc_params++;
+ if (ch == ';')
+ break;
+ #ifdef DEBUG_CONSOLE
+@@ -883,59 +904,37 @@ static void console_putchar(TextConsole *s, int ch)
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->y -= s->esc_params[0];
+- if (s->y < 0) {
+- s->y = 0;
+- }
++ set_cursor(s, s->x, s->y - s->esc_params[0]);
+ break;
+ case 'B':
+ /* move cursor down */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->y += s->esc_params[0];
+- if (s->y >= s->height) {
+- s->y = s->height - 1;
+- }
++ set_cursor(s, s->x, s->y + s->esc_params[0]);
+ break;
+ case 'C':
+ /* move cursor right */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->x += s->esc_params[0];
+- if (s->x >= s->width) {
+- s->x = s->width - 1;
+- }
++ set_cursor(s, s->x + s->esc_params[0], s->y);
+ break;
+ case 'D':
+ /* move cursor left */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->x -= s->esc_params[0];
+- if (s->x < 0) {
+- s->x = 0;
+- }
++ set_cursor(s, s->x - s->esc_params[0], s->y);
+ break;
+ case 'G':
+ /* move cursor to column */
+- s->x = s->esc_params[0] - 1;
+- if (s->x < 0) {
+- s->x = 0;
+- }
++ set_cursor(s, s->esc_params[0] - 1, s->y);
+ break;
+ case 'f':
+ case 'H':
+ /* move cursor to row, column */
+- s->x = s->esc_params[1] - 1;
+- if (s->x < 0) {
+- s->x = 0;
+- }
+- s->y = s->esc_params[0] - 1;
+- if (s->y < 0) {
+- s->y = 0;
+- }
++ set_cursor(s, s->esc_params[1] - 1, s->esc_params[0] - 1);
+ break;
+ case 'J':
+ switch (s->esc_params[0]) {
diff --git a/utils/xen/xsa-26.patch b/utils/xen/xsa-26.patch
new file mode 100644
index 0000000..e8b8e7d
--- /dev/null
+++ b/utils/xen/xsa-26.patch
@@ -0,0 +1,107 @@
+gnttab: fix releasing of memory upon switches between versions
+
+gnttab_unpopulate_status_frames() incompletely freed the pages
+previously used as status frame in that they did not get removed from
+the domain's xenpage_list, thus causing subsequent list corruption
+when those pages did get allocated again for the same or another purpose.
+
+Similarly, grant_table_create() and gnttab_grow_table() both improperly
+clean up in the event of an error - pages already shared with the guest
+can't be freed by just passing them to free_xenheap_page(). Fix this by
+sharing the pages only after all allocations succeeded.
+
+This is CVE-2012-5510 / XSA-26.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
+index 6c0aa6f..a180aef 100644
+--- a/xen/common/grant_table.c
++++ b/xen/common/grant_table.c
+@@ -1126,12 +1126,13 @@ fault:
+ }
+
+ static int
+-gnttab_populate_status_frames(struct domain *d, struct grant_table *gt)
++gnttab_populate_status_frames(struct domain *d, struct grant_table *gt,
++ unsigned int req_nr_frames)
+ {
+ unsigned i;
+ unsigned req_status_frames;
+
+- req_status_frames = grant_to_status_frames(gt->nr_grant_frames);
++ req_status_frames = grant_to_status_frames(req_nr_frames);
+ for ( i = nr_status_frames(gt); i < req_status_frames; i++ )
+ {
+ if ( (gt->status[i] = alloc_xenheap_page()) == NULL )
+@@ -1162,7 +1163,12 @@ gnttab_unpopulate_status_frames(struct domain *d,
struct grant_table *gt)
+
+ for ( i = 0; i < nr_status_frames(gt); i++ )
+ {
+- page_set_owner(virt_to_page(gt->status[i]), dom_xen);
++ struct page_info *pg = virt_to_page(gt->status[i]);
++
++ BUG_ON(page_get_owner(pg) != d);
++ if ( test_and_clear_bit(_PGC_allocated, &pg->count_info) )
++ put_page(pg);
++ BUG_ON(pg->count_info & ~PGC_xen_heap);
+ free_xenheap_page(gt->status[i]);
+ gt->status[i] = NULL;
+ }
+@@ -1200,19 +1206,18 @@ gnttab_grow_table(struct domain *d, unsigned int
req_nr_frames)
+ clear_page(gt->shared_raw[i]);
+ }
+
+- /* Share the new shared frames with the recipient domain */
+- for ( i = nr_grant_frames(gt); i < req_nr_frames; i++ )
+- gnttab_create_shared_page(d, gt, i);
+-
+- gt->nr_grant_frames = req_nr_frames;
+-
+ /* Status pages - version 2 */
+ if (gt->gt_version > 1)
+ {
+- if ( gnttab_populate_status_frames(d, gt) )
++ if ( gnttab_populate_status_frames(d, gt, req_nr_frames) )
+ goto shared_alloc_failed;
+ }
+
++ /* Share the new shared frames with the recipient domain */
++ for ( i = nr_grant_frames(gt); i < req_nr_frames; i++ )
++ gnttab_create_shared_page(d, gt, i);
++ gt->nr_grant_frames = req_nr_frames;
++
+ return 1;
+
+ shared_alloc_failed:
+@@ -2134,7 +2139,7 @@
gnttab_set_version(XEN_GUEST_HANDLE(gnttab_set_version_t uop))
+
+ if ( op.version == 2 && gt->gt_version < 2 )
+ {
+- res = gnttab_populate_status_frames(d, gt);
++ res = gnttab_populate_status_frames(d, gt, nr_grant_frames(gt));
+ if ( res < 0)
+ goto out_unlock;
+ }
+@@ -2449,9 +2454,6 @@ grant_table_create(
+ clear_page(t->shared_raw[i]);
+ }
+
+- for ( i = 0; i < INITIAL_NR_GRANT_FRAMES; i++ )
+- gnttab_create_shared_page(d, t, i);
+-
+ /* Status pages for grant table - for version 2 */
+ t->status = xmalloc_array(grant_status_t *,
+ grant_to_status_frames(max_nr_grant_frames));
+@@ -2459,6 +2461,10 @@ grant_table_create(
+ goto no_mem_4;
+ memset(t->status, 0,
+ grant_to_status_frames(max_nr_grant_frames) *
sizeof(t->status[0]));
++
++ for ( i = 0; i < INITIAL_NR_GRANT_FRAMES; i++ )
++ gnttab_create_shared_page(d, t, i);
++
+ t->nr_status_frames = 0;
+
+ /* Okay, install the structure. */
diff --git a/utils/xen/xsa-27.patch b/utils/xen/xsa-27.patch
new file mode 100644
index 0000000..f0764cb
--- /dev/null
+++ b/utils/xen/xsa-27.patch
@@ -0,0 +1,168 @@
+hvm: Limit the size of large HVM op batches
+
+Doing large p2m updates for HVMOP_track_dirty_vram without preemption
+ties up the physical processor. Integrating preemption into the p2m
+updates is hard so simply limit to 1GB which is sufficient for a 15000
+* 15000 * 32bpp framebuffer.
+
+For HVMOP_modified_memory and HVMOP_set_mem_type preemptible add the
+necessary machinery to handle preemption.
+
+This is CVE-2012-5511 / XSA-27.
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+x86/paging: Don't allocate user-controlled amounts of stack memory.
+
+This is XSA-27 / CVE-2012-5511.
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Acked-by: Jan Beulich <jbeulich AT suse.com>
+v2: Provide definition of GB to fix x86-32 compile.
+
+Signed-off-by: Jan Beulich <JBeulich AT suse.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+
+diff -r 5639047d6c9f xen/arch/x86/hvm/hvm.c
+--- a/xen/arch/x86/hvm/hvm.c Mon Nov 19 09:43:48 2012 +0100
++++ b/xen/arch/x86/hvm/hvm.c Mon Nov 19 16:00:33 2012 +0000
+@@ -3471,6 +3471,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ if ( !is_hvm_domain(d) )
+ goto param_fail2;
+
++ if ( a.nr > GB(1) >> PAGE_SHIFT )
++ goto param_fail2;
++
+ rc = xsm_hvm_param(d, op);
+ if ( rc )
+ goto param_fail2;
+@@ -3498,7 +3501,6 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ struct xen_hvm_modified_memory a;
+ struct domain *d;
+ struct p2m_domain *p2m;
+- unsigned long pfn;
+
+ if ( copy_from_guest(&a, arg, 1) )
+ return -EFAULT;
+@@ -3526,8 +3528,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ goto param_fail3;
+
+ p2m = p2m_get_hostp2m(d);
+- for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
++ while ( a.nr > 0 )
+ {
++ unsigned long pfn = a.first_pfn;
+ p2m_type_t t;
+ mfn_t mfn = gfn_to_mfn(p2m, pfn, &t);
+ if ( p2m_is_paging(t) )
+@@ -3548,6 +3551,19 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ /* don't take a long time and don't die either */
+ sh_remove_shadows(d->vcpu[0], mfn, 1, 0);
+ }
++
++ a.first_pfn++;
++ a.nr--;
++
++ /* Check for continuation if it's not the last interation */
++ if ( a.nr > 0 && hypercall_preempt_check() )
++ {
++ if ( copy_to_guest(arg, &a, 1) )
++ rc = -EFAULT;
++ else
++ rc = -EAGAIN;
++ break;
++ }
+ }
+
+ param_fail3:
+@@ -3595,7 +3611,6 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ struct xen_hvm_set_mem_type a;
+ struct domain *d;
+ struct p2m_domain *p2m;
+- unsigned long pfn;
+
+ /* Interface types to internal p2m types */
+ p2m_type_t memtype[] = {
+@@ -3625,8 +3640,9 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ goto param_fail4;
+
+ p2m = p2m_get_hostp2m(d);
+- for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
++ while ( a.nr > 0 )
+ {
++ unsigned long pfn = a.first_pfn;
+ p2m_type_t t;
+ p2m_type_t nt;
+ mfn_t mfn;
+@@ -3662,6 +3678,19 @@ long do_hvm_op(unsigned long op, XEN_GUE
+ goto param_fail4;
+ }
+ }
++
++ a.first_pfn++;
++ a.nr--;
++
++ /* Check for continuation if it's not the last interation */
++ if ( a.nr > 0 && hypercall_preempt_check() )
++ {
++ if ( copy_to_guest(arg, &a, 1) )
++ rc = -EFAULT;
++ else
++ rc = -EAGAIN;
++ goto param_fail4;
++ }
+ }
+
+ rc = 0;
+diff -r 5639047d6c9f xen/arch/x86/mm/paging.c
+--- a/xen/arch/x86/mm/paging.c Mon Nov 19 09:43:48 2012 +0100
++++ b/xen/arch/x86/mm/paging.c Mon Nov 19 16:00:33 2012 +0000
+@@ -529,13 +529,18 @@ int paging_log_dirty_range(struct domain
+
+ if ( !d->arch.paging.log_dirty.fault_count &&
+ !d->arch.paging.log_dirty.dirty_count ) {
+- int size = (nr + BITS_PER_LONG - 1) / BITS_PER_LONG;
+- unsigned long zeroes[size];
+- memset(zeroes, 0x00, size * BYTES_PER_LONG);
++ static uint8_t zeroes[PAGE_SIZE];
++ int off, size;
++
++ size = ((nr + BITS_PER_LONG - 1) / BITS_PER_LONG) * sizeof (long);
+ rv = 0;
+- if ( copy_to_guest_offset(dirty_bitmap, 0, (uint8_t *) zeroes,
+- size * BYTES_PER_LONG) != 0 )
+- rv = -EFAULT;
++ for ( off = 0; !rv && off < size; off += sizeof zeroes )
++ {
++ int todo = min(size - off, (int) PAGE_SIZE);
++ if ( copy_to_guest_offset(dirty_bitmap, off, zeroes, todo) )
++ rv = -EFAULT;
++ off += todo;
++ }
+ goto out;
+ }
+ d->arch.paging.log_dirty.fault_count = 0;
+diff -r 5639047d6c9f xen/include/asm-x86/config.h
+--- a/xen/include/asm-x86/config.h Mon Nov 19 09:43:48 2012 +0100
++++ b/xen/include/asm-x86/config.h Mon Nov 19 16:00:33 2012 +0000
+@@ -108,6 +108,9 @@ extern unsigned int trampoline_xen_phys_
+ extern unsigned char trampoline_cpu_started;
+ extern char wakeup_start[];
+ extern unsigned int video_mode, video_flags;
++
++#define GB(_gb) (_gb ## UL << 30)
++
+ #endif
+
+ #define asmlinkage
+@@ -123,7 +126,6 @@ extern unsigned int video_mode, video_fl
+ #define PML4_ADDR(_slot) \
+ ((((_slot ## UL) >> 8) * 0xffff000000000000UL) | \
+ (_slot ## UL << PML4_ENTRY_BITS))
+-#define GB(_gb) (_gb ## UL << 30)
+ #else
+ #define PML4_ENTRY_BYTES (1 << PML4_ENTRY_BITS)
+ #define PML4_ADDR(_slot) \
diff --git a/utils/xen/xsa-28.patch b/utils/xen/xsa-28.patch
new file mode 100644
index 0000000..fe4638e
--- /dev/null
+++ b/utils/xen/xsa-28.patch
@@ -0,0 +1,36 @@
+x86/HVM: range check xen_hvm_set_mem_access.hvmmem_access before use
+
+Otherwise an out of bounds array access can happen if changing the
+default access is being requested, which - if it doesn't crash Xen -
+would subsequently allow reading arbitrary memory through
+HVMOP_get_mem_access (again, unless that operation crashes Xen).
+
+This is XSA-28 / CVE-2012-5512.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Tim Deegan <tim AT xen.org>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
+index 66cf805..08b6418 100644
+--- a/xen/arch/x86/hvm/hvm.c
++++ b/xen/arch/x86/hvm/hvm.c
+@@ -3699,7 +3699,7 @@ long do_hvm_op(unsigned long op,
XEN_GUEST_HANDLE(void) arg)
+ return rc;
+
+ rc = -EINVAL;
+- if ( !is_hvm_domain(d) )
++ if ( !is_hvm_domain(d) || a.hvmmem_access >= ARRAY_SIZE(memaccess) )
+ goto param_fail5;
+
+ p2m = p2m_get_hostp2m(d);
+@@ -3719,9 +3719,6 @@ long do_hvm_op(unsigned long op,
XEN_GUEST_HANDLE(void) arg)
+ ((a.first_pfn + a.nr - 1) > domain_get_maximum_gpfn(d)) )
+ goto param_fail5;
+
+- if ( a.hvmmem_access >= ARRAY_SIZE(memaccess) )
+- goto param_fail5;
+-
+ for ( pfn = a.first_pfn; pfn < a.first_pfn + a.nr; pfn++ )
+ {
+ p2m_type_t t;
diff --git a/utils/xen/xsa-29.patch b/utils/xen/xsa-29.patch
new file mode 100644
index 0000000..f8f6e38
--- /dev/null
+++ b/utils/xen/xsa-29.patch
@@ -0,0 +1,49 @@
+xen: add missing guest address range checks to XENMEM_exchange handlers
+
+Ever since its existence (3.0.3 iirc) the handler for this has been
+using non address range checking guest memory accessors (i.e.
+the ones prefixed with two underscores) without first range
+checking the accessed space (via guest_handle_okay()), allowing
+a guest to access and overwrite hypervisor memory.
+
+This is XSA-29 / CVE-2012-5513.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
+index 2402984..1d877fc 100644
+--- a/xen/common/compat/memory.c
++++ b/xen/common/compat/memory.c
+@@ -114,6 +114,12 @@ int compat_memory_op(unsigned int cmd,
XEN_GUEST_HANDLE(void) compat)
+ (cmp.xchg.out.nr_extents << cmp.xchg.out.extent_order)) )
+ return -EINVAL;
+
++ if ( !compat_handle_okay(cmp.xchg.in.extent_start,
++ cmp.xchg.in.nr_extents) ||
++ !compat_handle_okay(cmp.xchg.out.extent_start,
++ cmp.xchg.out.nr_extents) )
++ return -EFAULT;
++
+ start_extent = cmp.xchg.nr_exchanged;
+ end_extent = (COMPAT_ARG_XLAT_SIZE - sizeof(*nat.xchg)) /
+ (((1U << ABS(order_delta)) + 1) *
+diff --git a/xen/common/memory.c b/xen/common/memory.c
+index 4e7c234..59379d3 100644
+--- a/xen/common/memory.c
++++ b/xen/common/memory.c
+@@ -289,6 +289,13 @@ static long
memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
+ goto fail_early;
+ }
+
++ if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) ||
++ !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) )
++ {
++ rc = -EFAULT;
++ goto fail_early;
++ }
++
+ /* Only privileged guests can allocate multi-page contiguous extents. */
+ if ( !multipage_allocation_permitted(current->domain,
+ exch.in.extent_order) ||
diff --git a/utils/xen/xsa-30.patch b/utils/xen/xsa-30.patch
new file mode 100644
index 0000000..817879a
--- /dev/null
+++ b/utils/xen/xsa-30.patch
@@ -0,0 +1,57 @@
+xen: fix error handling of guest_physmap_mark_populate_on_demand()
+
+The only user of the "out" label bypasses a necessary unlock, thus
+enabling the caller to lock up Xen.
+
+Also, the function was never meant to be called by a guest for itself,
+so rather than inspecting the code paths in depth for potential other
+problems this might cause, and adjusting e.g. the non-guest printk()
+in the above error path, just disallow the guest access to it.
+
+Finally, the printk() (considering its potential of spamming the log,
+the more that it's not using XENLOG_GUEST), is being converted to
+P2M_DEBUG(), as debugging is what it apparently was added for in the
+first place.
+
+This is XSA-30 / CVE-2012-5514.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Ian Campbell <ian.campbell AT citrix.com>
+Acked-by: George Dunlap <george.dunlap AT eu.citrix.com>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff -r 5639047d6c9f xen/arch/x86/mm/p2m.c
+--- a/xen/arch/x86/mm/p2m.c Mon Nov 19 09:43:48 2012 +0100
++++ b/xen/arch/x86/mm/p2m.c Thu Nov 22 17:07:37 2012 +0000
+@@ -2412,6 +2412,9 @@ guest_physmap_mark_populate_on_demand(st
+ mfn_t omfn;
+ int rc = 0;
+
++ if ( !IS_PRIV_FOR(current->domain, d) )
++ return -EPERM;
++
+ if ( !paging_mode_translate(d) )
+ return -EINVAL;
+
+@@ -2430,8 +2433,7 @@ guest_physmap_mark_populate_on_demand(st
+ omfn = gfn_to_mfn_query(p2m, gfn + i, &ot);
+ if ( p2m_is_ram(ot) )
+ {
+- printk("%s: gfn_to_mfn returned type %d!\n",
+- __func__, ot);
++ P2M_DEBUG("gfn_to_mfn returned type %d!\n", ot);
+ rc = -EBUSY;
+ goto out;
+ }
+@@ -2453,10 +2455,10 @@ guest_physmap_mark_populate_on_demand(st
+ BUG_ON(p2m->pod.entry_count < 0);
+ }
+
++out:
+ audit_p2m(p2m, 1);
+ p2m_unlock(p2m);
+
+-out:
+ return rc;
+ }
+
diff --git a/utils/xen/xsa-31.patch b/utils/xen/xsa-31.patch
new file mode 100644
index 0000000..1f3d929
--- /dev/null
+++ b/utils/xen/xsa-31.patch
@@ -0,0 +1,50 @@
+memop: limit guest specified extent order
+
+Allowing unbounded order values here causes almost unbounded loops
+and/or partially incomplete requests, particularly in PoD code.
+
+The added range checks in populate_physmap(), decrease_reservation(),
+and the "in" one in memory_exchange() architecturally all could use
+PADDR_BITS - PAGE_SHIFT, and are being artificially constrained to
+MAX_ORDER.
+
+This is XSA-31 / CVE-2012-5515.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Acked-by: Tim Deegan <tim AT xen.org>
+Acked-by: Ian Jackson <ian.jackson AT eu.citrix.com>
+
+diff --git a/xen/common/memory.c b/xen/common/memory.c
+index 4e7c234..9b9fb18 100644
+--- a/xen/common/memory.c
++++ b/xen/common/memory.c
+@@ -117,7 +117,8 @@ static void populate_physmap(struct memop_args *a)
+
+ if ( a->memflags & MEMF_populate_on_demand )
+ {
+- if ( guest_physmap_mark_populate_on_demand(d, gpfn,
++ if ( a->extent_order > MAX_ORDER ||
++ guest_physmap_mark_populate_on_demand(d, gpfn,
+ a->extent_order) < 0
)
+ goto out;
+ }
+@@ -216,7 +217,8 @@ static void decrease_reservation(struct memop_args *a)
+ xen_pfn_t gmfn;
+
+ if ( !guest_handle_subrange_okay(a->extent_list, a->nr_done,
+- a->nr_extents-1) )
++ a->nr_extents-1) ||
++ a->extent_order > MAX_ORDER )
+ return;
+
+ for ( i = a->nr_done; i < a->nr_extents; i++ )
+@@ -278,6 +280,9 @@ static long
memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg)
+ if ( (exch.nr_exchanged > exch.in.nr_extents) ||
+ /* Input and output domain identifiers match? */
+ (exch.in.domid != exch.out.domid) ||
++ /* Extent orders are sensible? */
++ (exch.in.extent_order > MAX_ORDER) ||
++ (exch.out.extent_order > MAX_ORDER) ||
+ /* Sizes of input and output lists do not overflow a long? */
+ ((~0UL >> exch.in.extent_order) < exch.in.nr_extents) ||
+ ((~0UL >> exch.out.extent_order) < exch.out.nr_extents) ||
- [SM-Commit] GIT changes to stable-0.61 grimoire by Vlad Glagolev (1008a4d4bf8d93092b217c7c21e426847280424a), Vlad Glagolev, 12/06/2012
Archive powered by MHonArc 2.6.24.