aports issueshttps://gitlab.alpinelinux.org/alpine/aports/-/issues2019-07-23T14:23:56Zhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1894Package request: freeswitch-mongodb2019-07-23T14:23:56ZJan-Hendrik DörnerPackage request: freeswitch-mongodbMongoDB is a leading NoSQL Database and is opensource.
http://www.mongodb.org/
Great would be to add the modules mod\_cdr\_mongodb (and mod\_mongo) to
the freeswitch package.
(Having the cdr in mongodb enables the installtion of cdr...MongoDB is a leading NoSQL Database and is opensource.
http://www.mongodb.org/
Great would be to add the modules mod\_cdr\_mongodb (and mod\_mongo) to
the freeswitch package.
(Having the cdr in mongodb enables the installtion of cdr-stats with
freeswitch.)
*(from redmine: issue id 1894, created on 2013-05-17, closed on 2019-05-03)*
* Relations:
* blocks #1182https://gitlab.alpinelinux.org/alpine/aports/-/issues/1893[2.5] libvirt: DoS (max count of open files exhaustion) due sockets leak in t...2019-07-23T14:23:56ZPeter Kotcauer[2.5] libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool (CVE-2013-1962)A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descripto...A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descriptors when ‘to list all volumes for the particular
pool’ request was issued (two socket file descriptors were leaked per
“list all pool volumes” request). An uprivileged user could use this
flaw to cause denial of service (make libvirtd daemon to exhaust /
reach
the maximum count of open file descriptors, the libvirtd daemon
process
was allowed to open, possibly preventing other users from use of
libvirtd services till the libvirtd daemon was restarted).
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=CVE-2013-1962
Upstream patch:
https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
*(from redmine: issue id 1893, created on 2013-05-16, closed on 2013-05-20)*
* Relations:
* relates #1891
* Changesets:
* Revision 832dda9bdea7a9be74826fe4b6cb1e3dac3dac0a on 2013-05-17T10:56:03Z:
```
main/libvirt: security fix for CVE-2013-1962. Fixes #1893
```Leonardo ArenaLeonardo Arenahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1892[2.6]libvirt: DoS (max count of open files exhaustion) due sockets leak in th...2019-07-23T14:23:57ZPeter Kotcauer[2.6]libvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool (CVE-2013-1962)A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descripto...A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descriptors when ‘to list all volumes for the particular
pool’ request was issued (two socket file descriptors were leaked per
“list all pool volumes” request). An uprivileged user could use this
flaw to cause denial of service (make libvirtd daemon to exhaust /
reach
the maximum count of open file descriptors, the libvirtd daemon
process
was allowed to open, possibly preventing other users from use of
libvirtd services till the libvirtd daemon was restarted).
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=CVE-2013-1962
Upstream patch:
https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
*(from redmine: issue id 1892, created on 2013-05-16, closed on 2013-05-20)*
* Relations:
* relates #1891
* Changesets:
* Revision 4628047e00483e7cd428cfe876de11334905df70 on 2013-05-17T09:04:18Z:
```
Security fix for CVE-2013-1962. Fixes #1892
```Leonardo ArenaLeonardo Arenahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1891libvirt: DoS (max count of open files exhaustion) due sockets leak in the sto...2019-07-23T14:23:58ZPeter Kotcauerlibvirt: DoS (max count of open files exhaustion) due sockets leak in the storage pool (CVE-2013-1962)A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descripto...A denial of service flaw was found in the way storage pool manager of
libvirt, a C toolkit to interact with the virtualization capabilities
of
recent versions of Linux (and other OSes), performed management of
socket file descriptors when ‘to list all volumes for the particular
pool’ request was issued (two socket file descriptors were leaked per
“list all pool volumes” request). An uprivileged user could use this
flaw to cause denial of service (make libvirtd daemon to exhaust /
reach
the maximum count of open file descriptors, the libvirtd daemon
process
was allowed to open, possibly preventing other users from use of
libvirtd services till the libvirtd daemon was restarted).
References:
https://bugzilla.redhat.com/show\_bug.cgi?id=CVE-2013-1962
Upstream patch:
https://www.redhat.com/archives/libvir-list/2013-May/msg01222.html
*(from redmine: issue id 1891, created on 2013-05-16, closed on 2013-05-20)*
* Relations:
* relates #1892
* relates #1893Leonardo ArenaLeonardo Arenahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1883[v2.2] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn...2019-07-23T14:24:05ZNatanael Copa[v2.2] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt (CVE-2013-2061)*(from redmine: issue id 1883, created on 2013-05-16, closed on 2013-05-20)*
* Changesets:
* Revision 265b2978a9ab1d19a88d8ea53e7b017b09b683d6 by Natanael Copa on 2013-05-16T11:48:58Z:
```
main/openvpn: security fix (CVE-2013-2061)
...*(from redmine: issue id 1883, created on 2013-05-16, closed on 2013-05-20)*
* Changesets:
* Revision 265b2978a9ab1d19a88d8ea53e7b017b09b683d6 by Natanael Copa on 2013-05-16T11:48:58Z:
```
main/openvpn: security fix (CVE-2013-2061)
fixes #1883
```https://gitlab.alpinelinux.org/alpine/aports/-/issues/1882[v2.3] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn...2019-07-23T14:24:06ZNatanael Copa[v2.3] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt (CVE-2013-2061)*(from redmine: issue id 1882, created on 2013-05-16, closed on 2013-05-20)*
* Changesets:
* Revision 6fc12c214333386dec234415ab2481ac5dcbcc61 by Natanael Copa on 2013-05-16T11:41:59Z:
```
main/openvpn: security fix (CVE-2013-2061)
...*(from redmine: issue id 1882, created on 2013-05-16, closed on 2013-05-20)*
* Changesets:
* Revision 6fc12c214333386dec234415ab2481ac5dcbcc61 by Natanael Copa on 2013-05-16T11:41:59Z:
```
main/openvpn: security fix (CVE-2013-2061)
fixes #1882
```https://gitlab.alpinelinux.org/alpine/aports/-/issues/1880[v2.4] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn...2019-07-23T14:24:07ZNatanael Copa[v2.4] OpenVPN: use of non-constant-time memcmp in HMAC comparison in openvpn_decrypt (CVE-2013-2061)*(from redmine: issue id 1880, created on 2013-05-16, closed on 2013-05-20)*
* Relations:
* parent #1865
* Changesets:
* Revision 48428d91b73c1141f947f4e7f9de8a924b49b101 by Natanael Copa on 2013-05-16T11:39:00Z:
```
main/openvpn: ...*(from redmine: issue id 1880, created on 2013-05-16, closed on 2013-05-20)*
* Relations:
* parent #1865
* Changesets:
* Revision 48428d91b73c1141f947f4e7f9de8a924b49b101 by Natanael Copa on 2013-05-16T11:39:00Z:
```
main/openvpn: security fix (CVE-2013-2061)
fixes #1880
```https://gitlab.alpinelinux.org/alpine/aports/-/issues/1869CVE-2013-2052: Libreswan remote buffer overflow in atodn()2019-07-23T14:24:13ZPeter KotcauerCVE-2013-2052: Libreswan remote buffer overflow in atodn()This alert (and any possible updates) is available at the following
URLs:
https://libreswan.org/security/CVE-2013-2052/
See also: Openswan atodn() CVE-2013-2053, Strongswan atodn()
CVE-2013-2054
An audit of code from The Libreswan Pr...This alert (and any possible updates) is available at the following
URLs:
https://libreswan.org/security/CVE-2013-2052/
See also: Openswan atodn() CVE-2013-2053, Strongswan atodn()
CVE-2013-2054
An audit of code from The Libreswan Project revealed a remote buffer
overflow
in the atodn() function used by both libreswan, openswan, and older
versions
of strongswan and superfreeswan when called from atoid()
Vulnerable versions: libreswan 3.0 and 3.1
Not vulnerable : libreswan 3.2 and 3.3
Vulnerability information
- ————————————-
When enabling Opportunistic Encryption (“OE”) using oe=yes (default is
‘no’) the IKE daemon pluto requests DNS TXT records to obtain public
RSA keys of itself and its peers. These records can contain an IPsec
gateway specification containing an fully qualified hostname which is
passed to a function atoid().
When X.509 support was added to FreeS/WAN, ASN.1 parsing was added to
the function atoid() which converts an ASCII ID representation into an
internal struct id representation using a static buffer via the
function
temporary\_cyclic\_buffer()
While DNS TXT records cannot contain ASN.1 representations, the code
mistakenly checked for such interpretation if the DNS TXT FQDN
contained
an ‘=’ symbol. Since DNS TXT buffers can be larger than what the ASN.1
parsing code expected, parsing such a record can trigger a buffer
overflow
leading to remote execution of code, specifically when overflowing
into
the struct kernel\_ops which is a table of function pointers.
Exploitation
- ——————
This exploit can only be triggered when the ipsec.conf configuration
file enables Opportunistic Encryption via the option ‘oe=yes’. If this
option is not present, it defaults to ‘no’.
Configurations that enable “OE” without preconfiguring their own
public
RSA key in DNS will be under severe connectivity problems leaving the
machine with 30 second delay for each outgoing connection - a
deployment
scenario that is extremely unlikely to appear in the wild.
In the unlikely event that machines are configured as such, this
vulnerability can only be exploited by a local attacker controlling
the reverse DNS entry for the IP address of the targetted host. If the
machine is properly configured for OE, an attacker only needs to
trigger
a connection to an IP address for which they control the reverse DNS
zone where they can place the malicious DNS record.
Workaround
- —————
If you cannot upgrade to libreswan version 3.2 or 3.3, the following
patch
addresses the vulnerability:
https://libreswan.org/security/CVE-2013-2052/7d0ca355.patch
Alternatively, the following patch can be used to permanently disable
the
oe=yes option:
diff —git a/lib/libipsecconf/keywords.c b/lib/libipsecconf/keywords.c
index b69d5e1..d7ca5a5 100644
\- —- a/lib/libipsecconf/keywords.c
<span class="underline"></span>+ b/lib/libipsecconf/keywords.c
@@ –381,7 +381,7 @@ struct keyword\_def
ipsec\_conf\_keywords\_v2\[\]={
{“plutofork”, kv\_config, kt\_bool, KBF\_PLUTOFORK,NOT\_ENUM},
{“perpeerlog”, kv\_config, kt\_bool, KBF\_PERPEERLOG,NOT\_ENUM},
{“perpeerlogdir”, kv\_config, kt\_dirname, KSF\_PERPEERDIR,NOT\_ENUM},
- - {“oe”, kv\_config, kt\_bool, KBF\_OPPOENCRYPT,NOT\_ENUM},
+ {“oe”, kv\_config, kt\_obsolete, KBF\_WARNIGNORE,NOT\_ENUM},
{“fragicmp”, kv\_config, kt\_bool, KBF\_FRAGICMP,NOT\_ENUM},
{“hidetos”, kv\_config, kt\_bool, KBF\_HIDETOS,NOT\_ENUM},
{“uniqueids”, kv\_config, kt\_bool, KBF\_UNIQUEIDS,NOT\_ENUM},
Related
- ———-
These functions are also used in other freeswan derivatives - openswan
1.x to 2.6.38,
strongswan 1.x to 4.3.4 and superfreeswan.
For full information regarding openswan, see CVE-2013-2053
For full information regarding strongswan, see CVE-2013-2054
Credits
- ———-
This vulnerability was found by Florian Weimer of the Red Hat Product
Security Team (https://access.redhat.com/security/team/)
About libreswan (https://libreswan.org/)
- ————————————————————
Libreswan is a free implementation of the Internet Protocol Security
(IPsec) suite and Internet Key Exchange (IKE) protocols. It is a
descendant (fork) of openswan 2.6.38.
IPsec uses strong cryptography to provide both authentication and
encryption services. These services allow you to build secure tunnels
through untrusted networks. Everything passing through the untrusted
network is encrypted by the IPsec gateway machine, and decrypted by
the gateway at the other end of the tunnel. The resulting tunnel is a
virtual private network (VPN).
*(from redmine: issue id 1869, created on 2013-05-15, closed on 2013-05-16)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/1868CVE-2013-2053 Openswan: remote buffer overflow in atodn()2022-01-06T22:26:22ZPeter KotcauerCVE-2013-2053 Openswan: remote buffer overflow in atodn()A buffer overflow flaw was found in Openswan. If Opportunistic
Encryption
were enabled (“oe=yes” in “/etc/ipsec.conf”) and an RSA key configured,
an
attacker able to cause a system to perform a DNS lookup for an
attacker-
controlle...A buffer overflow flaw was found in Openswan. If Opportunistic
Encryption
were enabled (“oe=yes” in “/etc/ipsec.conf”) and an RSA key configured,
an
attacker able to cause a system to perform a DNS lookup for an
attacker-
controlled domain containing malicious records (such as by sending an
email that triggers a DKIM or SPF DNS record lookup) could cause
Openswan’s pluto IKE daemon to crash or, potentially, execute
arbitrary
code with root privileges. With “oe=yes” but no RSA key configured,
the
issue can only be triggered by attackers on the local network who can
control the reverse DNS entry of the target system. Opportunistic
Encryption is disabled by default. (CVE-2013-2053)
*(from redmine: issue id 1868, created on 2013-05-15, closed on 2013-05-20)*
* Relations:
* child #1895https://gitlab.alpinelinux.org/alpine/aports/-/issues/1867CVE-2013-2070 nginx: denial of service or memory disclosure when using proxy_...2019-07-23T14:24:15ZPeter KotcauerCVE-2013-2070 nginx: denial of service or memory disclosure when using proxy_passA security problem related to CVE-2013-2028 was identified,
affecting some previous nginx versions if proxy\_pass to
untrusted upstream HTTP servers is used.
The problem may lead to a denial of service or a disclosure of a
worker ...A security problem related to CVE-2013-2028 was identified,
affecting some previous nginx versions if proxy\_pass to
untrusted upstream HTTP servers is used.
The problem may lead to a denial of service or a disclosure of a
worker process memory on a specially crafted response from an
upstream proxied server.
The problem affects nginx 1.1.4 - 1.2.8, 1.3.0 - 1.4.0.
The problem is already fixed in nginx 1.5.0, 1.4.1. Version 1.2.9
was released to address the issue in the 1.2.x legacy branch.
Patch for nginx 1.3.9 - 1.4.0 is the same as for CVE-2013-2028:
http://nginx.org/download/patch.2013.chunked.txt
Patch for older nginx versions (1.1.4 - 1.2.8, 1.3.0 - 1.3.8)
can be found here:
http://nginx.org/download/patch.2013.proxy.txt
*(from redmine: issue id 1867, created on 2013-05-15, closed on 2013-05-16)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/1866CVE-2013-2028 nginx: Stack-based buffer overflow when handling certain chunke...2019-07-23T14:24:16ZPeter KotcauerCVE-2013-2028 nginx: Stack-based buffer overflow when handling certain chunked transfer encoding requestsGreg MacManus, of iSIGHT Partners Labs, found a security problem
in several recent versions of nginx. A stack-based buffer
overflow might occur in a worker process while handling a
specially crafted request, potentially resulting i...Greg MacManus, of iSIGHT Partners Labs, found a security problem
in several recent versions of nginx. A stack-based buffer
overflow might occur in a worker process while handling a
specially crafted request, potentially resulting in arbitrary code
execution (CVE-2013-2028).
The problem affects nginx 1.3.9 - 1.4.0.
The problem is fixed in nginx 1.5.0, 1.4.1.
Patch for the problem can be found here:
http://nginx.org/download/patch.2013.chunked.txt
As a temporary workaround the following configuration
can be used in each server{} block:
if ($http\_transfer\_encoding ~\* chunked) {
return 444;
}
*(from redmine: issue id 1866, created on 2013-05-15, closed on 2013-05-16)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/1865CVE-2013-2061: OpenVPN use of non-constant-time memcmp in HMAC comparison in ...2019-07-23T14:24:16ZPeter KotcauerCVE-2013-2061: OpenVPN use of non-constant-time memcmp in HMAC comparison in openvpn_decryptExploit summary
OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen
ciphertext injection due to a non-constant-time HMAC comparison
function. Plaintext recovery may be possible using a padding oracle
attack on the...Exploit summary
OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen
ciphertext injection due to a non-constant-time HMAC comparison
function. Plaintext recovery may be possible using a padding oracle
attack on the CBC mode cipher implementation of the crypto library,
optimistically at a rate of about one character per 3 hours. PolarSSL
seems vulnerable to such an attack; the vulnerability of OpenSSL has
not
been verified or tested.
Severity
OpenVPN servers are typically configured to silently drop packets with
the wrong HMAC. For this reason measuring the processing time of the
packets is not trivial without a MITM position. In practice, the
attack
likely needs some target-specific information to be effective.
The severity of this vulnerability can be considered low. Only if
OpenVPN is configured to use a null-cipher, arbitrary plain-text can
be
injected which can completely open up this attack vector.
Affected versions
OpenVPN 2.3.0 and earlier are vulnerable. A fix (commit
f375aa67cc) is included in OpenVPN 2.3.1 and later.
References:
https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc
https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee
https://bugs.gentoo.org/show\_bug.cgi?id=468756
https://bugzilla.redhat.com/show\_bug.cgi?id=960192
*(from redmine: issue id 1865, created on 2013-05-15, closed on 2013-05-20)*
* Relations:
* child #1879
* child #1880https://gitlab.alpinelinux.org/alpine/aports/-/issues/1864mktemp incorrectly handles template-parameter2021-12-02T04:58:57ZAlexander Hirschmktemp incorrectly handles template-parameterWhat happens:
$ mktemp -u blah.tmp_XXXXXX
blah.T97AeK
$ mktemp -u /home/me/blah.tmp_XXXXXX
/home512h4b
Expected:
$ mktemp -u blah.tmp_XXXXXX
blah.tmp_T97AeK
$ mktemp -u /home/me/blah.tmp_XXXXXX
/home...What happens:
$ mktemp -u blah.tmp_XXXXXX
blah.T97AeK
$ mktemp -u /home/me/blah.tmp_XXXXXX
/home512h4b
Expected:
$ mktemp -u blah.tmp_XXXXXX
blah.tmp_T97AeK
$ mktemp -u /home/me/blah.tmp_XXXXXX
/home/me/blah.tmp_512h4b
*(from redmine: issue id 1864, created on 2013-05-15, closed on 2013-12-09)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/1847Package request: oath-toolkit2019-07-14T18:23:16ZV KrishnPackage request: oath-toolkitToolkit/lib:
http://www.nongnu.org/oath-toolkit/
Php:
http://pecl.php.net/package/oauth
Similarly for other scripts like lua, ruby, python where available.
*(from redmine: issue id 1847, created on 2013-05-05)*Toolkit/lib:
http://www.nongnu.org/oath-toolkit/
Php:
http://pecl.php.net/package/oauth
Similarly for other scripts like lua, ruby, python where available.
*(from redmine: issue id 1847, created on 2013-05-05)*Simon Fsimon-alpine@fraho.euSimon Fsimon-alpine@fraho.euhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1845Package request: mod_webauth (apache2 module)2019-07-24T15:21:13ZV KrishnPackage request: mod_webauth (apache2 module)Url:
http://webauth.stanford.edu/obtain.html
*(from redmine: issue id 1845, created on 2013-05-03)*Url:
http://webauth.stanford.edu/obtain.html
*(from redmine: issue id 1845, created on 2013-05-03)*Simon Fsimon-alpine@fraho.euSimon Fsimon-alpine@fraho.euhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1830Package request: XORP2019-07-24T15:21:22ZAvin SiguraniPackage request: XORPXorp ( http://www.xorp.org/ ) is a multicast capable router.
*(from redmine: issue id 1830, created on 2013-05-01)*
* Uploads:
* [APKBUILD](/uploads/8ebeb936b454ee62c9b2783a3003669d/APKBUILD)
* [Werror.patch](/uploads/12ea8486d59...Xorp ( http://www.xorp.org/ ) is a multicast capable router.
*(from redmine: issue id 1830, created on 2013-05-01)*
* Uploads:
* [APKBUILD](/uploads/8ebeb936b454ee62c9b2783a3003669d/APKBUILD)
* [Werror.patch](/uploads/12ea8486d5963874d4014f716e3dd2d6/Werror.patch)Simon Fsimon-alpine@fraho.euSimon Fsimon-alpine@fraho.euhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/1820Unable to run Alpine 2.3+ under VMWare2019-07-23T14:24:38ZRobert BoisvertUnable to run Alpine 2.3+ under VMWareIn VMWare 6 and 7.1.6 I can start Alpine 2.2.2 and lower from an Alpine
ISO file. But for Alpine 2.3 and greater all I get is the ISOLINUX line
and then the boot: line and then it hangs.
Did something change with 2.3 forward? Can it be ...In VMWare 6 and 7.1.6 I can start Alpine 2.2.2 and lower from an Alpine
ISO file. But for Alpine 2.3 and greater all I get is the ISOLINUX line
and then the boot: line and then it hangs.
Did something change with 2.3 forward? Can it be fixed to support
VMWare?
I searched Alpine and didn’t find any comments that seem to resolve this
problem.
*(from redmine: issue id 1820, created on 2013-04-24, closed on 2013-05-13)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/1798clang not building correctly2019-07-23T14:25:00ZDubiousjim .clang not building correctlyLooks like clang-3.2-r1 from edge won’t build a working executable even
for a simple one line program. Am I missing something?
$ cat test.c
int main(void) {return 0;}
$ clang -o test test.c
/usr/bin/ld: cannot find crtbegin.o: No ...Looks like clang-3.2-r1 from edge won’t build a working executable even
for a simple one line program. Am I missing something?
$ cat test.c
int main(void) {return 0;}
$ clang -o test test.c
/usr/bin/ld: cannot find crtbegin.o: No such file or directory
/usr/bin/ld: cannot find -lgcc
/usr/bin/ld: cannot find -lgcc
/usr/bin/ld: cannot find crtend.o: No such file or directory
clang: error: linker command failed with exit code 1 (use -v to see
invocation)
$ clang —version
clang version 3.2 (tags/RELEASE\_32/final)
Target: i386-pc-linux-gnu
Thread model: posix
$ \# huh, maybe it can’t find crtbegin.o and crtend.o because it’s
configured with the wrong target?
$ clang -target i486-alpine-linux-uclibc -o test test.c
$ \# ok, that SEEMED to work
$ ls -l test2
-rwxr-xr-x 1 jim users 3766 Apr 19 23:39 test2
$ ldd test2
checking sub-depends for ‘/lib/libc.so.0.9.32’
checking sub-depends for ‘/lib/ld-uClibc.so.0.9.32’
libc.so.0.9.32 =>/lib/libc.so.0.9.32 (0x00000000)
ld-uClibc.so.0.9.32 =>/lib/ld-uClibc.so.0.9.32 (0x00000000)
not a dynamic executable
$ \# why is it “not a dynamic executable”? I don’t get that message when
gcc builds it
$ \# Also, are the addresses for the libraries ok?
$ \# When gcc builds test.c, I get an executable with non-zero addresses
instead
$ \# Let’s see if we can execute the binary that clang built…
$ ./test2
ash: ./test2: not found
$ \# nope
*(from redmine: issue id 1798, created on 2013-04-20, closed on 2013-05-27)*
* Changesets:
* Revision fcc3343824cf767f0c245a71e491006902604a59 by Natanael Copa on 2013-04-23T15:43:13Z:
```
main/llvm: make it compile
- make it find dynamic linker
- set the target to i486-alpine-linux-uclibc
fixes #1798
```
* Uploads:
* [alpine-llvm.patch](/uploads/d27379fd050b408718c3cfa8610e8062/alpine-llvm.patch)
* [alpine-llvm-aports.patch](/uploads/a78ee2ec30aa62fed7cfc758b0c4e7c3/alpine-llvm-aports.patch) update aports to clang-3.2-r2https://gitlab.alpinelinux.org/alpine/aports/-/issues/1792Package request: libguestfs2019-07-23T13:32:05ZAlexander HirschPackage request: libguestfslibguestfs provides some tools for managing VM images.
Homepage: http://libguestfs.org/
Source (current stable):
http://libguestfs.org/download/1.20-stable/libguestfs-1.20.6.tar.gz
*(from redmine: issue id 1792, created on 2013-04-1...libguestfs provides some tools for managing VM images.
Homepage: http://libguestfs.org/
Source (current stable):
http://libguestfs.org/download/1.20-stable/libguestfs-1.20.6.tar.gz
*(from redmine: issue id 1792, created on 2013-04-18, closed on 2019-05-03)*
* Relations:
* duplicates #5770https://gitlab.alpinelinux.org/alpine/aports/-/issues/1776curl < 7.30.0 cookie leak vulnerability (CVE-2013-1944)2019-07-23T14:25:21ZNatanael Copacurl < 7.30.0 cookie leak vulnerability (CVE-2013-1944)1. VULNERABILITY
libcurl is vulnerable to a cookie leak vulnerability when doing
requests
across domains with matching tails.
When communicating over HTTP (S) and having libcurl’s cookie engine
enabled,
libcurl will store and hold ...1. VULNERABILITY
libcurl is vulnerable to a cookie leak vulnerability when doing
requests
across domains with matching tails.
When communicating over HTTP (S) and having libcurl’s cookie engine
enabled,
libcurl will store and hold cookies for use when subsequent requests
are
done to hosts and paths that match those kept cookies. Due to a bug in
the
tailmatching function, libcurl could wrongly send cookies meant for
the
domain ‘ample.com’ when communicating with ‘example.com’.
This vulnerability can be used to hijack sessions in targetted attacks
since
registering domains using a known domain’s name as an ending is trivial.
Both curl the command line tool and applications using the libcurl
library
are vulnerable.
There are no known exploits available at this time.
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name
CVE-2013-1944 to this issue.
2. AFFECTED VERSIONS
Affected versions: all versions to and including 7.29.0
Not affected versions: curl >= 7.30.0
libcurl is used by many applications, but not always advertised as such!
3. THE SOLUTION
libcurl 7.30.0 implements the function properly and will not send
cookies to
sites just because the host names use the same tail.
4. RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order
of
preference:
A - Upgrade to curl and libcurl 7.30.0
B - Apply this patch and rebuild libcurl
http://curl.haxx.se/curl-tailmatch.patch
C - Disable use of cookies or HTTP entirely in your application
5. TIME LINE
Vulnerability found and patched by YAMADA Yasuharu.
It was reported (publicly) to the curl project on April 9th 2013.
curl 7.30.0 was released on April 12th 2013, coordinated with the
publication of this advisory.
6. CREDITS
Reported and fixed by YAMADA Yasuharu. Thanks a lot!
*(from redmine: issue id 1776, created on 2013-04-12, closed on 2013-04-17)*
* Relations:
* child #1777
* child #1778
* child #1779
* child #1780
* child #1781Natanael CopaNatanael Copa