see https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d

infinite-loop is CVE-2019-6462

closes #13013

(cherry picked from commit 2cac7499)

closes #13805

Ariadne Conill authored Apr 23, 2022 and alice committed May 11, 2022

thanks to sam@gentoo.org for pointing this out

upstream patch: https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2

upstream bug report: https://github.com/madler/zlib/issues/618

alpine bug report: #13711

fixes "java.util.zip.ZipException: invalid entry CRC" in Java JRE/JDK on 64-bit systems

this backports the fix from master to 3.12-stable

(cherry picked from commit 6754a900)

omni authored Apr 29, 2022 and Natanael Copa committed May 11, 2022

Fixes: #13650

- CVE-2022-22576
- CVE-2022-27774
- CVE-2022-27775
- CVE-2022-27776

With my limitations, in knowledge and time, I chose to create one .patch
file with all the commits to the upstream stable-4.13 branch from 4.13.4
releas up till and including the currently latest commit:

git format-patch b4bb02d^..fe97133 --stdout > xen-stable-4.13_git20220408.patch

This includes CVE/XSA patches, prerequisites and additional fixes.

https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13