nforro pushed to libtiff (rawhide). "Fix CVE-2022-34526 (#2112760)"
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 08:19:50 UTC
From a2b0acdb533440925183a13e76175531a3b4b37c Mon Sep 17 00:00:00 2001
From: Nikola Forró <nforro(a)redhat.com>
Date: Aug 01 2022 07:12:11 +0000
Subject: Fix CVE-2022-34526 (#2112760)
---
diff --git a/libtiff-CVE-2022-34526.patch b/libtiff-CVE-2022-34526.patch
new file mode 100644
index 0000000..cb3a4d3
--- /dev/null
+++ b/libtiff-CVE-2022-34526.patch
@@ -0,0 +1,28 @@
+From 275735d0354e39c0ac1dc3c0db2120d6f31d1990 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault(a)spatialys.com>
+Date: Mon, 27 Jun 2022 16:09:43 +0200
+Subject: [PATCH] _TIFFCheckFieldIsValidForCodec(): return FALSE when passed a
+ codec-specific tag and the codec is not configured (fixes #433)
+
+This avoids crashes when querying such tags
+---
+ libtiff/tif_dirinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index c30f569b..3371cb5c 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -1191,6 +1191,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
+ default:
+ return 1;
+ }
++ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
++ return 0;
++ }
+ /* Check if codec specific tags are allowed for the current
+ * compression scheme (codec) */
+ switch (tif->tif_dir.td_compression) {
+--
+GitLab
+
diff --git a/libtiff.spec b/libtiff.spec
index 3face3d..d52fc91 100644
--- a/libtiff.spec
+++ b/libtiff.spec
@@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.4.0
-Release: 3%{?dist}
+Release: 4%{?dist}
License: libtiff
URL: http://www.simplesystems.org/libtiff/
@@ -10,6 +10,7 @@ Source: http://download.osgeo.org/libtiff/tiff-%{version}.tar.gz
Patch0: libtiff-am-version.patch
Patch1: libtiff-make-check.patch
Patch2: libtiff-CVE-2022-2056_2057_2058.patch
+Patch3: libtiff-CVE-2022-34526.patch
BuildRequires: gcc, gcc-c++
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel
@@ -62,6 +63,7 @@ image files using the libtiff library.
%patch0 -p1
%patch1 -p1
%patch2 -p1
+%patch3 -p1
# Use build system's libtool.m4, not the one in the package.
rm -f libtool.m4
@@ -166,6 +168,9 @@ find html -name 'Makefile*' | xargs rm
%{_mandir}/man1/*
%changelog
+* Mon Aug 01 2022 Nikola Forró <nforro(a)redhat.com> - 4.4.0-4
+- Fix CVE-2022-34526 (#2112760)
+
* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.4.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
https://src.fedoraproject.org/rpms/libtiff/c/a2b0acdb533440925183a13e7617...
1 year, 9 months
nforro pushed to libtiff (f36). "Fix CVE-2022-34526 (#2112760)"
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 08:19:34 UTC
From a2b0acdb533440925183a13e76175531a3b4b37c Mon Sep 17 00:00:00 2001
From: Nikola Forró <nforro(a)redhat.com>
Date: Aug 01 2022 07:12:11 +0000
Subject: Fix CVE-2022-34526 (#2112760)
---
diff --git a/libtiff-CVE-2022-34526.patch b/libtiff-CVE-2022-34526.patch
new file mode 100644
index 0000000..cb3a4d3
--- /dev/null
+++ b/libtiff-CVE-2022-34526.patch
@@ -0,0 +1,28 @@
+From 275735d0354e39c0ac1dc3c0db2120d6f31d1990 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault(a)spatialys.com>
+Date: Mon, 27 Jun 2022 16:09:43 +0200
+Subject: [PATCH] _TIFFCheckFieldIsValidForCodec(): return FALSE when passed a
+ codec-specific tag and the codec is not configured (fixes #433)
+
+This avoids crashes when querying such tags
+---
+ libtiff/tif_dirinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index c30f569b..3371cb5c 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -1191,6 +1191,9 @@ _TIFFCheckFieldIsValidForCodec(TIFF *tif, ttag_t tag)
+ default:
+ return 1;
+ }
++ if( !TIFFIsCODECConfigured(tif->tif_dir.td_compression) ) {
++ return 0;
++ }
+ /* Check if codec specific tags are allowed for the current
+ * compression scheme (codec) */
+ switch (tif->tif_dir.td_compression) {
+--
+GitLab
+
diff --git a/libtiff.spec b/libtiff.spec
index 3face3d..d52fc91 100644
--- a/libtiff.spec
+++ b/libtiff.spec
@@ -1,7 +1,7 @@
Summary: Library of functions for manipulating TIFF format image files
Name: libtiff
Version: 4.4.0
-Release: 3%{?dist}
+Release: 4%{?dist}
License: libtiff
URL: http://www.simplesystems.org/libtiff/
@@ -10,6 +10,7 @@ Source: http://download.osgeo.org/libtiff/tiff-%{version}.tar.gz
Patch0: libtiff-am-version.patch
Patch1: libtiff-make-check.patch
Patch2: libtiff-CVE-2022-2056_2057_2058.patch
+Patch3: libtiff-CVE-2022-34526.patch
BuildRequires: gcc, gcc-c++
BuildRequires: zlib-devel libjpeg-devel jbigkit-devel libzstd-devel libwebp-devel
@@ -62,6 +63,7 @@ image files using the libtiff library.
%patch0 -p1
%patch1 -p1
%patch2 -p1
+%patch3 -p1
# Use build system's libtool.m4, not the one in the package.
rm -f libtool.m4
@@ -166,6 +168,9 @@ find html -name 'Makefile*' | xargs rm
%{_mandir}/man1/*
%changelog
+* Mon Aug 01 2022 Nikola Forró <nforro(a)redhat.com> - 4.4.0-4
+- Fix CVE-2022-34526 (#2112760)
+
* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.4.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
https://src.fedoraproject.org/rpms/libtiff/c/a2b0acdb533440925183a13e7617...
1 year, 9 months
tkorbar pushed to libyang (rawhide). "Clean specfile and remove
obsolete tag that is not relevant"
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 08:10:34 UTC
From bc25757d476983b8cb1ee6a37922ab262f063a5a Mon Sep 17 00:00:00 2001
From: Tomas Korbar <tkorbar(a)redhat.com>
Date: Aug 01 2022 08:10:06 +0000
Subject: Clean specfile and remove obsolete tag that is not relevant
---
diff --git a/libyang.spec b/libyang.spec
index f1e0d94..3170bf4 100644
--- a/libyang.spec
+++ b/libyang.spec
@@ -8,7 +8,7 @@
Name: libyang
Version: 2.0.231
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: YANG data modeling language library
Url: https://github.com/CESNET/libyang
Source: %{url}/archive/v%{version}.tar.gz
@@ -23,7 +23,6 @@ BuildRequires: pkgconfig(libpcre2-8) >= 10.21
BuildRequires: valgrind
Conflicts: %{name} < 1.0.225-3
-Obsoletes: libyang2
%package devel
Summary: Development files for libyang
@@ -64,28 +63,12 @@ written (and providing API) in C.
-DENABLE_VALGRIND_TESTS=%{run_valgrind_tests}
%cmake_build
-%if %fedora == 34
- %ifarch %{arm}
- pushd armv7hl-redhat-linux-gnueabi
- %else
- pushd %{_host}
- %endif
-%else
- pushd redhat-linux-build
-%endif
+pushd redhat-linux-build
make doc
popd
%check
-%if %fedora == 34
- %ifarch %{arm}
- pushd armv7hl-redhat-linux-gnueabi
- %else
- pushd %{_host}
- %endif
-%else
- pushd redhat-linux-build
-%endif
+pushd redhat-linux-build
ctest --output-on-failure -V %{?_smp_mflags}
popd
@@ -120,6 +103,9 @@ cp -a doc/html %{buildroot}/%{_docdir}/libyang/html
%{_docdir}/libyang
%changelog
+* Mon Aug 01 2022 Tomas Korbar <tkorbar(a)redhat.com> - 2.0.231-2
+- Clean specfile and remove obsolete tag that is not relevant
+
* Wed Jul 27 2022 Jakub Ružička <jakub.ruzicka(a)nic.cz> - 2.0.231-1
- Rebase to version 2.0.231 (Resolves: rhbz#2111304)
- Own yang modules (Resolves: rhbz#2094371)
https://src.fedoraproject.org/rpms/libyang/c/bc25757d476983b8cb1ee6a37922...
1 year, 9 months
slp pushed to rust-krunvm (rawhide). "Initial import
(fedora#2104123)."
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 08:02:48 UTC
From 9b6dcaa5b6faa632d71d71bdd0fd8d808a7ed7a8 Mon Sep 17 00:00:00 2001
From: Sergio Lopez <slp(a)redhat.com>
Date: Aug 01 2022 08:03:11 +0000
Subject: Initial import (fedora#2104123).
---
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b5e9d71
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/krunvm-0.1.6.crate
diff --git a/krunvm-remove-text_io.diff b/krunvm-remove-text_io.diff
new file mode 100644
index 0000000..6ef7c25
--- /dev/null
+++ b/krunvm-remove-text_io.diff
@@ -0,0 +1,11 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index b2e9a5c..f2c2083 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -32,6 +32,3 @@ version = "1.0.120"
+
+ [dependencies.serde_derive]
+ version = "1.0.120"
+-
+-[dependencies.text_io]
+-version = "0.1.8"
diff --git a/rust-krunvm.spec b/rust-krunvm.spec
new file mode 100644
index 0000000..cfaf20f
--- /dev/null
+++ b/rust-krunvm.spec
@@ -0,0 +1,97 @@
+# Generated by rust2rpm 21
+%bcond_without check
+
+%global crate krunvm
+
+Name: rust-%{crate}
+Version: 0.1.6
+Release: 1%{?dist}
+Summary: Create microVMs from OCI images
+
+# Upstream license specification: Apache-2.0
+License: ASL 2.0
+URL: https://crates.io/crates/krunvm
+Source: %{crates_source}
+# Remove dependency on text_io crate, as it's only used on macOS
+Patch0: krunvm-remove-text_io.diff
+
+# This crate depends on libkrun and it's only available on x86_64 and aarch64
+ExclusiveArch: x86_64 aarch64
+
+BuildRequires: rust-packaging >= 21
+BuildRequires: libkrun-devel
+BuildRequires: asciidoctor
+
+%global _description %{expand:
+Create microVMs from OCI images.}
+
+%description %{_description}
+
+%package -n %{crate}
+Summary: %{summary}
+# ASL 2.0: krunvm
+# MIT or ASL 2.0: rust-bitflags 1.3.2
+# MIT or ASL 2.0: rust-directories 3.0.2
+# MIT or ASL 2.0: rust-dirs-sys 0.3.7
+# MIT or ASL 2.0: rust-libc 0.2.126
+# MIT or ASL 2.0: rust-proc-macro2 1.0.40
+# MIT or ASL 2.0: rust-quote 1.0.18
+# MIT or ASL 2.0: rust-serde 1.0.137
+# MIT or ASL 2.0: rust-serde_derive 1.0.137
+# MIT or ASL 2.0: rust-syn 1.0.98
+# MIT or ASL 2.0: rust-toml 0.5.9
+# MIT or ASL 2.0: rust-unicode-ident 1.0.1
+# MIT or ASL 2.0: rust-unicode-width 0.1.9
+# MIT or ASL 2.0: rust-vec_map 0.8.2
+# MIT or MIT or ASL 2.0: rust-confy 0.4.0
+# MIT: rust-ansi_term 0.12.1
+# MIT: rust-atty 0.2.14
+# MIT: rust-clap2 2.34.0
+# MIT: rust-strsim 0.10.0
+# MIT: rust-textwrap0.11 0.11.0
+License: ASL 2.0 and MIT
+Requires: buildah
+
+%description -n %{crate} %{_description}
+
+%files -n %{crate}
+%license LICENSE
+%doc CODE-OF-CONDUCT.md README.md SECURITY.md
+%{_bindir}/krunvm
+%{_mandir}/man1/krunvm*.1*
+
+%prep
+%autosetup -n %{crate}-%{version_no_tilde} -p1
+%cargo_prep
+
+%generate_buildrequires
+%cargo_generate_buildrequires
+
+%build
+%cargo_build
+
+%install
+%cargo_install
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-changevm.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-config.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-create.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-delete.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-list.1
+install -Dpm0644 -t %{buildroot}%{_mandir}/man1 \
+ target/release/build/%{crate}-*/out/krunvm-start.1
+
+%if %{with check}
+%check
+%cargo_test
+%endif
+
+%changelog
+* Mon Jul 18 2022 Sergio Lopez <slp(a)redhat.com> - 0.1.6-1
+- Initial package
diff --git a/sources b/sources
new file mode 100644
index 0000000..00c127b
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+SHA512 (krunvm-0.1.6.crate) = 2a2eb39793f7e8dbf7c405e1a820c6cb9ff769223961fdea211889065876d983dab30780e1b1aaf8b6c449c9ec1471b4774b1721d274f41bab2c898361066a75
https://src.fedoraproject.org/rpms/rust-krunvm/c/9b6dcaa5b6faa632d71d71bd...
1 year, 9 months
mattia pushed to stellarsolver (f36). "Update License tags to SPDX
identifiers"
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 07:01:38 UTC
From 83a643d77965d51b52ed79ad885fd46f6a95c537 Mon Sep 17 00:00:00 2001
From: Mattia Verga <mattia.verga(a)proton.me>
Date: Jul 31 2022 13:27:59 +0000
Subject: Update License tags to SPDX identifiers
---
diff --git a/stellarsolver.spec b/stellarsolver.spec
index c517674..022fb6b 100644
--- a/stellarsolver.spec
+++ b/stellarsolver.spec
@@ -5,7 +5,7 @@ Name: stellarsolver
Version: 2.4
Release: %autorelease
Summary: The Cross Platform Sextractor and Internal Astrometric Solver
-License: BSD and GPLv2+ and GPLv3+ and LGPLv2+ and LGPLv3+ and MIT
+License: BSD-3-Clause and GPL-2.0-or-later and GPL-3.0-or-later and LGPL-2.0-or-later and LGPL-3.0-or-later and MIT
# License breakdown
#
# Whole work according to LICENSE: GPLv3+
https://src.fedoraproject.org/rpms/stellarsolver/c/83a643d77965d51b52ed79...
1 year, 9 months
mattia pushed to stellarsolver (f36). "Update to 2.4 (Fedora#2112629)"
by notifications@fedoraproject.org
Notification time stamped 2022-08-01 07:01:38 UTC
From b99faf327b1936078f1a6826b01e6123a70ca4e0 Mon Sep 17 00:00:00 2001
From: Mattia Verga <mattia.verga(a)proton.me>
Date: Jul 31 2022 13:14:00 +0000
Subject: Update to 2.4 (Fedora#2112629)
---
diff --git a/.gitignore b/.gitignore
index d068f44..15c90e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
/stellarsolver-832bc60feb1fc8ffdf2780ccdd413c3baea648fb.tar.gz
/stellarsolver-2.2.tar.gz
/stellarsolver-2.3.tar.gz
+/stellarsolver-2.4.tar.gz
diff --git a/sources b/sources
index c48bf50..e1f82aa 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (stellarsolver-2.3.tar.gz) = f55454d9cdb85282590ffe5ed8fccd028973f41355bac3dfd668e2ad589061e54d3b17363d34434619d6a5d8055829fad10f9486040f9cc7ff05423f85a01075
+SHA512 (stellarsolver-2.4.tar.gz) = f397ddafd3bb4774ac89e95673f67c4fef40ea0be842555608d95978ee26949b21b16cc984e00e936eda2ceca316f604b784b44844cf37ad1e44a5ef8d7e75f8
diff --git a/stellarsolver.spec b/stellarsolver.spec
index 1300a09..c517674 100644
--- a/stellarsolver.spec
+++ b/stellarsolver.spec
@@ -1,8 +1,8 @@
%global major_soversion 2
-%global minor_soversion 3
+%global minor_soversion 4
Name: stellarsolver
-Version: 2.3
+Version: 2.4
Release: %autorelease
Summary: The Cross Platform Sextractor and Internal Astrometric Solver
License: BSD and GPLv2+ and GPLv3+ and LGPLv2+ and LGPLv3+ and MIT
@@ -83,9 +83,6 @@ developing applications that use %{name}.
%prep
%forgesetup
-# Minor fix for the desktop file - reported upstream
-sed -i s/Version=2.2/Version=1.4/g ./stellarbatchsolver/com.github.rlancaste.stellarbatchsolver.desktop
-
%build
%cmake -DBUILD_TESTER=ON \
@@ -96,9 +93,6 @@ sed -i s/Version=2.2/Version=1.4/g ./stellarbatchsolver/com.github.rlancaste.ste
%install
%cmake_install
-# Remove unwanted files copied into icons directory
-find %{buildroot}%{_datadir} -name ".DS_Store" -exec rm -rf {} \;
-
%check
desktop-file-validate %{buildroot}%{_datadir}/applications/com.github.rlancaste.%{name}.desktop
https://src.fedoraproject.org/rpms/stellarsolver/c/b99faf327b1936078f1a68...
1 year, 9 months