Bug 200200
| Summary: | [security] multimedia/kodi: Security vulnerability (CVE-2015-3885) | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Ports & Packages | Reporter: | Sevan Janiyan <venture37> | ||||||||||
| Component: | Individual Port(s) | Assignee: | freebsd-ports-bugs (Nobody) <ports-bugs> | ||||||||||
| Status: | Closed FIXED | ||||||||||||
| Severity: | Affects Only Me | CC: | delphij, junovitch, mickael.maillot, ports-secteam | ||||||||||
| Priority: | --- | Keywords: | needs-qa, patch | ||||||||||
| Version: | Latest | Flags: | koobs:
maintainer-feedback+
|
||||||||||
| Hardware: | Any | ||||||||||||
| OS: | Any | ||||||||||||
| Attachments: |
|
||||||||||||
|
Description
Sevan Janiyan
2015-05-14 17:13:12 UTC
Created attachment 157249 [details]
patch for CVE-2015-3885
just put1 the file on multimedia/kodi/files
and but port revision.
Created attachment 157303 [details] security/vuxml: document kodi with dcraw entry security/vuxml: Extend 57325ecf-facc-11e4-968f-b888e347c638 to cover kodi as well. # make validate /bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy" >>> Validating... /usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml >>> Successful. Checking if tidy differs... ... seems okay Checking for space/tab... ... seems okay /usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml # env PKG_DBDIR=/usr/ports/security/vuxml pkg audit kodi-14.2 kodi-14.2 is vulnerable: kodi, rawstudio, and ufraw -- integer overflow condition CVE: CVE-2015-3885 WWW: http://vuxml.FreeBSD.org/freebsd/57325ecf-facc-11e4-968f-b888e347c638.html 1 problem(s) in the installed packages found. # env PKG_DBDIR=/usr/ports/security/vuxml pkg audit kodi-14.2_1 0 problem(s) in the installed packages found. Created attachment 157304 [details]
multimedia/kodi: bump to 14.2_1 and apply fix for dcraw
Transition maintainer provided patch into SVN friendly patch.
QA is pending. This looks like it will take me a while to build on all releases in Poudriere. I'll updated later.
Created attachment 157313 [details]
Poudriere Build Log from 11.0-CURRENT amd64
needs-qa finished on the following platforms. 11.0 log is attached for review. That did take a little while to verify but this should be ready for commit.
Bulk build tested on the following releases (info from `poudriere jail -l`)
8.4-RELEASE-p28 amd64
8.4-RELEASE-p28 i386
9.3-RELEASE-p14 amd64
9.3-RELEASE-p14 i386
10.1-RELEASE-p10 amd64
10.1-RELEASE-p10 i386
11.0-CURRENT r282869 amd64
11.0-CURRENT r282869 i386
A commit references this bug: Author: delphij Date: Mon Jun 1 07:24:49 UTC 2015 New revision: 388203 URL: https://svnweb.freebsd.org/changeset/ports/388203 Log: - Add kodi to 57325ecf-facc-11e4-968f-b888e347c638 [1] - Update entry dates for newly added entry. PR: 200200 [1] Submitted by: Jason Unovitch [1] Changes: head/security/vuxml/vuln.xml A commit references this bug: Author: delphij Date: Mon Jun 1 07:29:03 UTC 2015 New revision: 388205 URL: https://svnweb.freebsd.org/changeset/ports/388205 Log: Fix CVE-2015-3885. PR: 200200 Submitted by: maintainer Reported by: Sevan Janiyan Tested by: Jason Unovitch Security: 57325ecf-facc-11e4-968f-b888e347c638 Security: CVE-2015-3885 MFH: 2015Q2 Changes: head/multimedia/kodi/Makefile head/multimedia/kodi/files/patch-lib_cximage-6.0_raw_dcraw.c Committed, thanks! A commit references this bug: Author: delphij Date: Mon Jun 1 07:30:29 UTC 2015 New revision: 388206 URL: https://svnweb.freebsd.org/changeset/ports/388206 Log: MFH: r388205 Fix CVE-2015-3885. PR: 200200 Submitted by: maintainer Reported by: Sevan Janiyan Tested by: Jason Unovitch Security: 57325ecf-facc-11e4-968f-b888e347c638 Security: CVE-2015-3885 Approved by: ports-secteam Changes: _U branches/2015Q2/ branches/2015Q2/multimedia/kodi/Makefile branches/2015Q2/multimedia/kodi/files/patch-lib_cximage-6.0_raw_dcraw.c |
