diff --git a/SPECS/zlib/CVE-2022-37434.patch b/SPECS/zlib/CVE-2022-37434.patch deleted file mode 100644 index 930c114dd47..00000000000 --- a/SPECS/zlib/CVE-2022-37434.patch +++ /dev/null @@ -1,39 +0,0 @@ -From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Sat, 30 Jul 2022 15:51:11 -0700 -Subject: [PATCH 1/3] Fix a bug when getting a gzip header extra field with - inflate(). - -If the extra field was larger than the space the user provided with -inflateGetHeader(), and if multiple calls of inflate() delivered -the extra header data, then there could be a buffer overflow of the -provided space. This commit assures that provided space is not -exceeded. - -backported by @mfrw to 1.2.12 on 2022-08-16 - -Signed-off-by: Muhammad Falak R Wani ---- - inflate.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/inflate.c b/inflate.c -index 7be8c63..7a72897 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,9 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -+ len = state->head->extra_len - state->length; - if (state->head != Z_NULL && -- state->head->extra != Z_NULL) { -- len = state->head->extra_len - state->length; -+ state->head->extra != Z_NULL && -+ len < state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); --- -2.37.2 - diff --git a/SPECS/zlib/Fix-extra-field-processing-bug-that-dereferences-NULL.patch b/SPECS/zlib/Fix-extra-field-processing-bug-that-dereferences-NULL.patch deleted file mode 100644 index 2ddccb30cf5..00000000000 --- a/SPECS/zlib/Fix-extra-field-processing-bug-that-dereferences-NULL.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Mon, 8 Aug 2022 10:50:09 -0700 -Subject: [PATCH 3/3] Fix extra field processing bug that dereferences NULL - state->head. - -The recent commit to fix a gzip header extra field processing bug -introduced the new bug fixed here. - -backported by @mfrw to 1.2.12 on 2022-08-16 - -Signed-off-by: Muhammad Falak R Wani ---- - inflate.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/inflate.c b/inflate.c -index 7a72897..2a3c4fe 100644 ---- a/inflate.c -+++ b/inflate.c -@@ -763,10 +763,10 @@ int flush; - copy = state->length; - if (copy > have) copy = have; - if (copy) { -- len = state->head->extra_len - state->length; - if (state->head != Z_NULL && - state->head->extra != Z_NULL && -- len < state->head->extra_max) { -+ (len = state->head->extra_len - state->length) < -+ state->head->extra_max) { - zmemcpy(state->head->extra + len, next, - len + copy > state->head->extra_max ? - state->head->extra_max - len : copy); --- -2.37.2 - diff --git a/SPECS/zlib/zlib.signatures.json b/SPECS/zlib/zlib.signatures.json index 452e72062df..3bcb78da4a0 100644 --- a/SPECS/zlib/zlib.signatures.json +++ b/SPECS/zlib/zlib.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "zlib-1.2.12.tar.xz": "7db46b8d7726232a621befaab4a1c870f00a90805511c0e0090441dac57def18" + "zlib-1.2.13.tar.xz": "d14c38e313afc35a9a8760dadf26042f51ea0f5d154b0630a31da0540107fb98" } } \ No newline at end of file diff --git a/SPECS/zlib/zlib.spec b/SPECS/zlib/zlib.spec index d7febef1903..52c11c39c42 100644 --- a/SPECS/zlib/zlib.spec +++ b/SPECS/zlib/zlib.spec @@ -1,15 +1,13 @@ Summary: Compression and decompression routines Name: zlib -Version: 1.2.12 -Release: 2%{?dist} +Version: 1.2.13 +Release: 1%{?dist} URL: https://www.zlib.net/ License: zlib Group: Applications/System Vendor: Microsoft Corporation Distribution: Mariner Source0: https://www.zlib.net/%{name}-%{version}.tar.xz -Patch0: CVE-2022-37434.patch -Patch1: Fix-extra-field-processing-bug-that-dereferences-NULL.patch %description Compression and decompression routines %package devel @@ -51,8 +49,12 @@ make %{?_smp_mflags} check %{_mandir}/man3/zlib.3.gz %changelog +* Thu Apr 27 2023 Muhammad Falak - 1.2.13-1 +- Upgrade version to address java exception +- Drop un-needed patches + * Tue Aug 16 2022 Muhammad Falak - 1.2.12-2 -- Introduce patches from upstrea to address CVE-2022-37434 +- Introduce patches from upstream to address CVE-2022-37434 * Tue Apr 12 2022 Nicolas Guibourge - 1.2.12-1 - Upgrade to 1.12.2 to fix CVE-2018-25032