rpms/ocaml-mysql/devel ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch, NONE, 1.1 ocaml-mysql.spec, 1.10, 1.11
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-mysql/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv17694
Modified Files:
ocaml-mysql.spec
Added Files:
ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.0.4-11
- Patch for CVE 2009-2942 Missing escape function (RHBZ#529321).
ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch:
mysql.ml | 18 ++++++++++++------
mysql.mli | 5 +++++
mysql_stubs.c | 27 +++++++++++++++++++++++++++
3 files changed, 44 insertions(+), 6 deletions(-)
--- NEW FILE ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch ---
diff -ur ocaml-mysql-1.0.4.orig/mysql.ml ocaml-mysql-1.0.4/mysql.ml
--- ocaml-mysql-1.0.4.orig/mysql.ml 2006-02-23 22:13:22.000000000 +0000
+++ ocaml-mysql-1.0.4/mysql.ml 2009-10-16 11:42:08.074508283 +0100
@@ -333,6 +333,7 @@
external real_status : dbd -> int = "db_status"
external errmsg : dbd -> string option = "db_errmsg"
external escape : string -> string = "db_escape"
+external real_escape: dbd -> string -> string = "db_real_escape"
external fetch : result -> string option array option = "db_fetch"
external to_row : result -> int64 -> unit = "db_to_row"
external size : result -> int64 = "db_size"
@@ -516,7 +517,9 @@
the corresponding type *)
let ml2str str = "'" ^ escape str ^ "'"
+let ml2rstr conn str = "'" ^ real_escape conn str ^ "'"
let ml2blob = ml2str
+let ml2rblob = ml2rstr
let ml2int x = string_of_int x
let ml2decimal x = x
let ml322int x = Int32.to_string x
@@ -524,12 +527,15 @@
let mlnative2int x = Nativeint.to_string x
let ml2float x = string_of_float x
let ml2enum x = escape x
-let ml2set x = let rec loop arg = match arg with
- | [] -> ""
- | [x] -> escape x
- | x::y::ys -> escape x ^ "," ^ loop (y::ys)
- in
- loop x
+let ml2renum x = real_escape x
+let ml2set_filter f x =
+ let rec loop f = function
+ | [] -> ""
+ | [x] -> f x
+ | x::y::ys -> f x ^ "," ^ loop f (y::ys)
+ in loop f x
+let ml2set x = ml2set_filter escape x
+let ml2rset conn x = ml2set_filter (real_escape conn) x
let ml2datetimel ~year ~month ~day ~hour ~min ~sec =
Printf.sprintf "'%04d-%02d-%02d %02d:%02d:%02d'"
diff -ur ocaml-mysql-1.0.4.orig/mysql.mli ocaml-mysql-1.0.4/mysql.mli
--- ocaml-mysql-1.0.4.orig/mysql.mli 2006-02-23 22:13:22.000000000 +0000
+++ ocaml-mysql-1.0.4/mysql.mli 2009-10-16 11:42:08.075507981 +0100
@@ -230,6 +230,7 @@
(** [escape str] returns the same string as [str] in MySQL syntax with
special characters quoted to not confuse the MySQL parser *)
val escape : string -> string
+val real_escape : dbd -> string -> string
(** [xxx2ml str] decodes a MySQL value of type xxx into a corresponding
OCaml value *)
@@ -277,14 +278,18 @@
(** [ml2xxx v] encodes [v] into MySQL syntax. *)
val ml2str : string -> string
+val ml2rstr : dbd -> string -> string
val ml2blob : string -> string
+val ml2rblob : dbd -> string -> string
val ml2int : int -> string
val ml2decimal : string -> string
val ml322int : int32 -> string
val ml642int : int64 -> string
val ml2float : float -> string
val ml2enum : string -> string
+val ml2renum : dbd -> string -> string
val ml2set : string list -> string
+val ml2rset : dbd -> string list -> string
val ml2datetime : int * int * int * int * int * int -> string
val ml2datetimel : year:int -> month:int -> day:int -> hour:int -> min:int -> sec:int -> string
val ml2date : int * int * int -> string
diff -ur ocaml-mysql-1.0.4.orig/mysql_stubs.c ocaml-mysql-1.0.4/mysql_stubs.c
--- ocaml-mysql-1.0.4.orig/mysql_stubs.c 2006-02-23 23:12:36.000000000 +0000
+++ ocaml-mysql-1.0.4/mysql_stubs.c 2009-10-16 11:42:08.076508492 +0100
@@ -472,6 +472,33 @@
CAMLreturn(res);
}
+EXTERNAL value
+db_real_escape(value dbd, value str)
+{
+ CAMLparam2(dbd, str);
+ char *s;
+ char *buf;
+ int len, esclen;
+ MYSQL *mysql;
+ CAMLlocal1(res);
+
+ check_dbd(dbd, "escape");
+ mysql = DBDmysql(dbd);
+
+ s = String_val(str);
+ len = string_length(str);
+ buf = (char*) stat_alloc(2*len+1);
+ caml_enter_blocking_section();
+ esclen = mysql_real_escape_string(mysql,buf,s,len);
+ caml_leave_blocking_section();
+
+ res = alloc_string(esclen);
+ memcpy(String_val(res), buf, esclen);
+ stat_free(buf);
+
+ CAMLreturn(res);
+}
+
/*
* db_size -- returns the size of the current result (number of rows).
*/
Index: ocaml-mysql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-mysql/devel/ocaml-mysql.spec,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -p -r1.10 -r1.11
--- ocaml-mysql.spec 25 Jul 2009 20:00:13 -0000 1.10
+++ ocaml-mysql.spec 16 Oct 2009 10:43:31 -0000 1.11
@@ -3,7 +3,7 @@
Name: ocaml-mysql
Version: 1.0.4
-Release: 10%{?dist}
+Release: 11%{?dist}
Summary: OCaml library for accessing MySQL databases
Group: Development/Libraries
@@ -13,6 +13,8 @@ Source0: http://raevnos.pennmush.
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
ExcludeArch: sparc64 s390 s390x
+Patch0: ocaml-mysql-1.0.4-CVE-2009-2942-missing-escape.patch
+
BuildRequires: ocaml >= 3.10.0
BuildRequires: ocaml-findlib-devel
BuildRequires: ocaml-ocamldoc
@@ -46,6 +48,7 @@ developing applications that use %{name}
%prep
%setup -q
+%patch0 -p1
./configure --libdir=%{_libdir}
@@ -97,6 +100,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.0.4-11
+- Patch for CVE 2009-2942 Missing escape function (RHBZ#529321).
+
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.0.4-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
14 years, 6 months
rpms/ocaml-postgresql/F-11 ocaml-postgresql.spec,1.14,1.15
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12935
Modified Files:
ocaml-postgresql.spec
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc11.2
- Fix build process for new upstream tarball layout.
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/ocaml-postgresql.spec,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -p -r1.14 -r1.15
--- ocaml-postgresql.spec 16 Oct 2009 10:19:00 -0000 1.14
+++ ocaml-postgresql.spec 16 Oct 2009 10:25:24 -0000 1.15
@@ -3,7 +3,7 @@
Name: ocaml-postgresql
Version: 1.12.3
-Release: 1%{?dist}
+Release: 1%{?dist}.2
Summary: OCaml library for accessing PostgreSQL databases
Group: Development/Libraries
@@ -82,7 +82,7 @@ rm -rf $RPM_BUILD_ROOT
%files devel
%defattr(-,root,root,-)
-%doc LICENSE AUTHORS Changes README.txt examples
+%doc LICENSE AUTHORS Changelog README.txt examples
%if %opt
%{_libdir}/ocaml/postgresql/*.a
%{_libdir}/ocaml/postgresql/*.cmxa
@@ -91,6 +91,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc11.2
+- Fix build process for new upstream tarball layout.
+
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
14 years, 6 months
rpms/ocaml-postgresql/F-10 ocaml-postgresql.spec,1.7,1.8
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12703
Modified Files:
ocaml-postgresql.spec
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc10.2
- Fix build process for new upstream tarball layout.
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/ocaml-postgresql.spec,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -p -r1.7 -r1.8
--- ocaml-postgresql.spec 16 Oct 2009 10:18:58 -0000 1.7
+++ ocaml-postgresql.spec 16 Oct 2009 10:24:21 -0000 1.8
@@ -3,13 +3,13 @@
Name: ocaml-postgresql
Version: 1.12.3
-Release: 1%{?dist}
+Release: 1%{?dist}.2
Summary: OCaml library for accessing PostreSQL databases
Group: Development/Libraries
License: LGPLv2+ with exceptions
URL: http://www.ocaml.info/home/ocaml_sources.html#toc13
-Source0: http://www.ocaml.info/ocaml_sources/postgresql-ocaml-%{version}.tar.bz2
+Source0: http://hg.ocaml.info/release/postgresql-ocaml/archive/release-%{version}....
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: ocaml >= 3.10.0
@@ -44,7 +44,7 @@ developing applications that use %{name}
%prep
-%setup -q -n postgresql-ocaml-%{version}
+%setup -q -n postgresql-ocaml-release-%{version}
%build
@@ -82,7 +82,7 @@ rm -rf $RPM_BUILD_ROOT
%files devel
%defattr(-,root,root,-)
-%doc LICENSE AUTHORS Changes README examples
+%doc LICENSE AUTHORS Changelog README.txt examples
%if %opt
%{_libdir}/ocaml/postgresql/*.a
%{_libdir}/ocaml/postgresql/*.cmxa
@@ -91,6 +91,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1.fc10.2
+- Fix build process for new upstream tarball layout.
+
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
14 years, 6 months
rpms/ocaml-postgresql/F-12 .cvsignore, 1.6, 1.7 ocaml-postgresql.spec, 1.16, 1.17 sources, 1.6, 1.7
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11004
Modified Files:
.cvsignore ocaml-postgresql.spec sources
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
https://bugzilla.redhat.com/show_bug.cgi?id=529325
CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
HOWEVER you are not protected until you change your code to
use the new connection#escape_string method.
Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/.cvsignore,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -p -r1.6 -r1.7
--- .cvsignore 23 May 2009 08:12:43 -0000 1.6
+++ .cvsignore 16 Oct 2009 10:19:01 -0000 1.7
@@ -1 +1 @@
-release-1.11.1.tar.bz2
+release-1.12.3.tar.bz2
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/ocaml-postgresql.spec,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -p -r1.16 -r1.17
--- ocaml-postgresql.spec 25 Jul 2009 20:03:37 -0000 1.16
+++ ocaml-postgresql.spec 16 Oct 2009 10:19:01 -0000 1.17
@@ -2,8 +2,8 @@
%define debug_package %{nil}
Name: ocaml-postgresql
-Version: 1.11.1
-Release: 2%{?dist}
+Version: 1.12.3
+Release: 1%{?dist}
Summary: OCaml library for accessing PostgreSQL databases
Group: Development/Libraries
@@ -92,6 +92,14 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
+- New upstream version 1.12.3.
+- This contains a SECURITY fix for:
+ https://bugzilla.redhat.com/show_bug.cgi?id=529325
+ CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
+ HOWEVER you are not protected until you change your code to
+ use the new connection#escape_string method.
+
* Sat Jul 25 2009 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.11.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-12/sources,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -p -r1.6 -r1.7
--- sources 23 May 2009 08:12:43 -0000 1.6
+++ sources 16 Oct 2009 10:19:01 -0000 1.7
@@ -1 +1 @@
-d293714bd15824db031a47d1c42c1f36 release-1.11.1.tar.bz2
+64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2
14 years, 6 months
rpms/ocaml-postgresql/F-11 .cvsignore, 1.5, 1.6 ocaml-postgresql.spec, 1.13, 1.14 sources, 1.5, 1.6
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11025
Modified Files:
.cvsignore ocaml-postgresql.spec sources
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
https://bugzilla.redhat.com/show_bug.cgi?id=529325
CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
HOWEVER you are not protected until you change your code to
use the new connection#escape_string method.
Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/.cvsignore,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -p -r1.5 -r1.6
--- .cvsignore 10 Mar 2009 14:06:41 -0000 1.5
+++ .cvsignore 16 Oct 2009 10:19:00 -0000 1.6
@@ -1 +1 @@
-release-1.10.3.tar.bz2
+release-1.12.3.tar.bz2
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/ocaml-postgresql.spec,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -p -r1.13 -r1.14
--- ocaml-postgresql.spec 10 Mar 2009 14:06:41 -0000 1.13
+++ ocaml-postgresql.spec 16 Oct 2009 10:19:00 -0000 1.14
@@ -2,7 +2,7 @@
%define debug_package %{nil}
Name: ocaml-postgresql
-Version: 1.10.3
+Version: 1.12.3
Release: 1%{?dist}
Summary: OCaml library for accessing PostgreSQL databases
@@ -91,6 +91,14 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
+- New upstream version 1.12.3.
+- This contains a SECURITY fix for:
+ https://bugzilla.redhat.com/show_bug.cgi?id=529325
+ CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
+ HOWEVER you are not protected until you change your code to
+ use the new connection#escape_string method.
+
* Tue Mar 10 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.10.3-1
- New upstream version 1.10.3.
- Fix URL.
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-11/sources,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -p -r1.5 -r1.6
--- sources 10 Mar 2009 14:06:41 -0000 1.5
+++ sources 16 Oct 2009 10:19:00 -0000 1.6
@@ -1 +1 @@
-ebac79d610e5be1cfb39b69be2865e5d release-1.10.3.tar.bz2
+64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2
14 years, 6 months
rpms/ocaml-postgresql/F-10 .cvsignore, 1.3, 1.4 ocaml-postgresql.spec, 1.6, 1.7 sources, 1.3, 1.4
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11044
Modified Files:
.cvsignore ocaml-postgresql.spec sources
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
https://bugzilla.redhat.com/show_bug.cgi?id=529325
CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
HOWEVER you are not protected until you change your code to
use the new connection#escape_string method.
Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/.cvsignore,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -p -r1.3 -r1.4
--- .cvsignore 4 Apr 2008 11:53:16 -0000 1.3
+++ .cvsignore 16 Oct 2009 10:18:58 -0000 1.4
@@ -1 +1 @@
-postgresql-ocaml-1.8.2.tar.bz2
+release-1.12.3.tar.bz2
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/ocaml-postgresql.spec,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -p -r1.6 -r1.7
--- ocaml-postgresql.spec 23 Apr 2008 11:10:18 -0000 1.6
+++ ocaml-postgresql.spec 16 Oct 2009 10:18:58 -0000 1.7
@@ -2,8 +2,8 @@
%define debug_package %{nil}
Name: ocaml-postgresql
-Version: 1.8.2
-Release: 4%{?dist}
+Version: 1.12.3
+Release: 1%{?dist}
Summary: OCaml library for accessing PostreSQL databases
Group: Development/Libraries
@@ -91,6 +91,14 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
+- New upstream version 1.12.3.
+- This contains a SECURITY fix for:
+ https://bugzilla.redhat.com/show_bug.cgi?id=529325
+ CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
+ HOWEVER you are not protected until you change your code to
+ use the new connection#escape_string method.
+
* Wed Apr 23 2008 Richard W.M. Jones <rjones(a)redhat.com> - 1.8.2-4
- Rebuild for OCaml 3.10.2
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/F-10/sources,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -p -r1.3 -r1.4
--- sources 4 Apr 2008 11:53:16 -0000 1.3
+++ sources 16 Oct 2009 10:18:58 -0000 1.4
@@ -1 +1 @@
-3ba2746c46e223d82b3ba32835ba6635 postgresql-ocaml-1.8.2.tar.bz2
+64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2
14 years, 6 months
rpms/ocaml-postgresql/devel .cvsignore, 1.7, 1.8 ocaml-postgresql.spec, 1.17, 1.18 sources, 1.7, 1.8
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-postgresql/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv9553
Modified Files:
.cvsignore ocaml-postgresql.spec sources
Log Message:
* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
- New upstream version 1.12.3.
- This contains a SECURITY fix for:
https://bugzilla.redhat.com/show_bug.cgi?id=529325
CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
HOWEVER you are not protected until you change your code to
use the new connection#escape_string method.
Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/.cvsignore,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -p -r1.7 -r1.8
--- .cvsignore 4 Oct 2009 21:03:48 -0000 1.7
+++ .cvsignore 16 Oct 2009 10:14:19 -0000 1.8
@@ -1 +1 @@
-release-1.12.1.tar.bz2
+release-1.12.3.tar.bz2
Index: ocaml-postgresql.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/ocaml-postgresql.spec,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -p -r1.17 -r1.18
--- ocaml-postgresql.spec 4 Oct 2009 21:03:49 -0000 1.17
+++ ocaml-postgresql.spec 16 Oct 2009 10:14:19 -0000 1.18
@@ -2,8 +2,8 @@
%define debug_package %{nil}
Name: ocaml-postgresql
-Version: 1.12.1
-Release: 2%{?dist}
+Version: 1.12.3
+Release: 1%{?dist}
Summary: OCaml library for accessing PostgreSQL databases
Group: Development/Libraries
@@ -92,6 +92,14 @@ rm -rf $RPM_BUILD_ROOT
%changelog
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.3-1
+- New upstream version 1.12.3.
+- This contains a SECURITY fix for:
+ https://bugzilla.redhat.com/show_bug.cgi?id=529325
+ CVE-2009-2943 ocaml-postgresql: Missing escape function (DSA-1909-1)
+ HOWEVER you are not protected until you change your code to
+ use the new connection#escape_string method.
+
* Sun Oct 4 2009 Richard W.M. Jones <rjones(a)redhat.com> - 1.12.1-1
- New upstream version 1.12.1.
Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-postgresql/devel/sources,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -p -r1.7 -r1.8
--- sources 4 Oct 2009 21:03:49 -0000 1.7
+++ sources 16 Oct 2009 10:14:19 -0000 1.8
@@ -1 +1 @@
-e912df9259d74c123660072e12335871 release-1.12.1.tar.bz2
+64d6fdc1a23dc3315c61771f1d28f592 release-1.12.3.tar.bz2
14 years, 6 months
[Bug 509531] New: CVE-2009-2295 ocaml-camlimages: PNG reader multiple integer overflows (oCERT-2009-009)
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: CVE-2009-2295 ocaml-camlimages: PNG reader multiple integer overflows (oCERT-2009-009)
Alias: CVE-2009-2295
https://bugzilla.redhat.com/show_bug.cgi?id=509531
Summary: CVE-2009-2295 ocaml-camlimages: PNG reader multiple
integer overflows (oCERT-2009-009)
Product: Security Response
Version: unspecified
Platform: All
OS/Version: Linux
Status: NEW
Keywords: Security
Severity: medium
Priority: medium
Component: vulnerability
AssignedTo: security-response-team(a)redhat.com
ReportedBy: thoger(a)redhat.com
CC: rjones(a)redhat.com, fedora-ocaml-list(a)redhat.com
Classification: Other
Target Release: ---
oCERT advisory oCERT-2009-009 was published describing a flaw in
ocaml-camlimages:
http://www.ocert.org/advisories/ocert-2009-009.html
CamlImages, an open source image processing library, suffers from several
integer overflows which may lead to a potentially exploitable heap
overflow and result in arbitrary code execution.
The vulnerability is triggered by PNG image parsing, the read_png_file
and read_png_file_as_rgb24 functions do not properly validate the width
and height of the image. Specific PNG images with large width and height
can be crafted to trigger the vulnerability.
Issue was reported to affect both 2.2 and 3.0.1, which no upstream patch
available at the moment.
References:
http://thread.gmane.org/gmane.comp.security.oss.general/1882
http://bugs.gentoo.org/show_bug.cgi?id=276235
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
14 years, 6 months
rpms/ocaml-camlimages/EL-5 ocaml-camlimages.spec,1.5,1.6
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-camlimages/EL-5
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv30231
Modified Files:
ocaml-camlimages.spec
Log Message:
- Changed dep back to 'lablgtk' so this can build.
Index: ocaml-camlimages.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-camlimages/EL-5/ocaml-camlimages.spec,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -p -r1.5 -r1.6
--- ocaml-camlimages.spec 16 Oct 2009 09:49:59 -0000 1.5
+++ ocaml-camlimages.spec 16 Oct 2009 09:56:41 -0000 1.6
@@ -1,6 +1,6 @@
Name: ocaml-camlimages
Version: 2.2.0
-Release: 11%{?dist}
+Release: 12%{?dist}
Summary: OCaml image processing library
Group: Development/Libraries
@@ -18,7 +18,7 @@ Patch2: camlimages-oversized-tif
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: ocaml-lablgtk libpng-devel libjpeg-devel ocaml
+BuildRequires: lablgtk libpng-devel libjpeg-devel ocaml
BuildRequires: libXpm-devel ghostscript-devel freetype-devel
BuildRequires: giflib-devel
Requires: ocaml
@@ -80,9 +80,10 @@ rm -rf $RPM_BUILD_ROOT
%changelog
-* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-11
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-12
- ocaml-camlimages: TIFF reader multiple integer overflows
(CVE 2009-3296 / RHBZ#528732).
+- Changed dep back to 'lablgtk' so this can build.
* Fri Jul 3 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-10
- ocaml-camlimages: PNG reader multiple integer overflows
14 years, 6 months
rpms/ocaml-camlimages/EL-4 ocaml-camlimages.spec,1.4,1.5
by Richard W.M. Jones
Author: rjones
Update of /cvs/pkgs/rpms/ocaml-camlimages/EL-4
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv6665
Modified Files:
ocaml-camlimages.spec
Log Message:
Force rebuild.
Index: ocaml-camlimages.spec
===================================================================
RCS file: /cvs/pkgs/rpms/ocaml-camlimages/EL-4/ocaml-camlimages.spec,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -p -r1.4 -r1.5
--- ocaml-camlimages.spec 16 Oct 2009 09:51:57 -0000 1.4
+++ ocaml-camlimages.spec 16 Oct 2009 09:52:23 -0000 1.5
@@ -1,6 +1,6 @@
Name: ocaml-camlimages
Version: 2.2.0
-Release: 9%{?dist}
+Release: 10%{?dist}
Summary: OCaml image processing library
Group: Development/Libraries
@@ -83,7 +83,7 @@ rm -rf $RPM_BUILD_ROOT
%changelog
-* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-9
+* Fri Oct 16 2009 Richard W.M. Jones <rjones(a)redhat.com> - 2.2.0-10
- ocaml-camlimages: TIFF reader multiple integer overflows
(CVE 2009-3296 / RHBZ#528732).
14 years, 6 months