GitLab

infinite-loop is CVE-2019-6462

closes #13013

(cherry picked from commit 2cac7499)

closes #13805

Ariadne Conill authored Apr 23, 2022 and alice committed May 11, 2022

thanks to sam@gentoo.org for pointing this out

upstream patch: https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2

upstream bug report: https://github.com/madler/zlib/issues/618

alpine bug report: #13711

fixes "java.util.zip.ZipException: invalid entry CRC" in Java JRE/JDK on 64-bit systems

this backports the fix from master to 3.12-stable

(cherry picked from commit 6754a900)

omni authored Apr 29, 2022 and Natanael Copa committed May 11, 2022

Fixes: #13650

- CVE-2022-22576
- CVE-2022-27774
- CVE-2022-27775
- CVE-2022-27776

With my limitations, in knowledge and time, I chose to create one .patch
file with all the commits to the upstream stable-4.13 branch from 4.13.4
releas up till and including the currently latest commit:

git format-patch b4bb02d^..fe97133 --stdout > xen-stable-4.13_git20220408.patch

This includes CVE/XSA patches, prerequisites and additional fixes.

https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13

This is now done directly by the lint script

Due to recent changes in git, the owner of the repository files matter.
In CI, the repository is cloned by root, while the CI jobs run as a
non-root user. This causes git to fail with an error message.

This was already fixed in the ci build script, but the `before_script`
is run before that, and now starts to fail because the updated git
version is part of the image itself.

Because we fetch the commits in the build script anyway, lets just
remove the before_script.

fixes #8097