From debbugs-submit-bounces@debbugs.gnu.org Thu Mar 16 17:40:14 2017 Received: (at submit) by debbugs.gnu.org; 16 Mar 2017 21:40:15 +0000 Received: from localhost ([127.0.0.1]:59365 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cod7v-0004lN-2V for submit@debbugs.gnu.org; Thu, 16 Mar 2017 17:40:14 -0400 Received: from eggs.gnu.org ([208.118.235.92]:55843) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cod7r-0004ko-7m for submit@debbugs.gnu.org; Thu, 16 Mar 2017 17:40:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cod7k-00045N-2w for submit@debbugs.gnu.org; Thu, 16 Mar 2017 17:39:58 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:33836) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cod7j-00045B-VT for submit@debbugs.gnu.org; Thu, 16 Mar 2017 17:39:56 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46804) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cod7h-0007GL-OD for guix-patches@gnu.org; Thu, 16 Mar 2017 17:39:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cod7e-00042o-BJ for guix-patches@gnu.org; Thu, 16 Mar 2017 17:39:53 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:37645) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cod7d-00042A-WB for guix-patches@gnu.org; Thu, 16 Mar 2017 17:39:50 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 1EB8820BC5; Thu, 16 Mar 2017 17:39:47 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Thu, 16 Mar 2017 17:39:47 -0400 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=famulari.name; h= content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=8RD hUpvNDmjt3NkCKqgSsEEOgac=; b=wM4CWi3aD1zX48GE5wElWTfHoMRI0fzLe0B 8nV685m0Y7XN6QhclGoxyBGX1+ub7VmBgrmrjbhIDYZDq7z6MwND+vqCFAzvxxqW Y55EzXVfK0zAmzIfEY3YuBNIJewKCT93+LHpUxOBdIiDMQo4DXmJFEQRhhhQ590q FaIrOe7c= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=fm1; bh=8RDhUpvNDmjt3NkCKqgSsEEOgac=; b=b96JbR7cm mQyPmTyZND/DWBIzLQSVxJ+LRQrSoBBTmWA9sKoOCEoTFNEvR4S4Za07oy8Lez+D S1KD5kMC+ZbvSMzPD3XIeyy+4Btra/KsLu75I0Cxknml0D4SQ0+2Vgiba5qqKGPa yI6VZVcInJrfdMPvQ7seRtgUeAjW62NFhDwxkift02KdHY/P4yqpIuHWGICq+z+q Q/ycV2Q9zTbOiwi05KCiN1oHDktpZHOXReEFmBiHozg7mUPHH1y3flAKUTZl6ugw MWiOY/gvsN/QffpBGT/QgQeq2YiZSODskscs1PLxao7xu2kPsU9EKLgpbslq0hwx dMjlVgD6XbR2w== X-ME-Sender: X-Sasl-enc: lVBv5v00qGfYfhsvC1wOrd+jN4BAaDzQp8v2XndaQBVB 1489700386 Received: from localhost (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id BFA8B24626 for ; Thu, 16 Mar 2017 17:39:46 -0400 (EDT) Date: Thu, 16 Mar 2017 17:39:45 -0400 From: Leo Famulari To: guix-patches@gnu.org Subject: QEMU and virglrenderer security CVE-2017-6386 CVE-2017-2620 CVE-2017-2630 Message-ID: <20170316213945.GA8120@jasmine> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="DKU6Jbt7q3WqK7+M" Content-Disposition: inline User-Agent: Mutt/1.8.0 (2017-02-23) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.9 (/) --DKU6Jbt7q3WqK7+M Content-Type: multipart/mixed; boundary="Nq2Wo0NMKNjxTN9z" Content-Disposition: inline --Nq2Wo0NMKNjxTN9z Content-Type: text/plain; charset=us-ascii Content-Disposition: inline --Nq2Wo0NMKNjxTN9z Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="0001-gnu-virglrenderer-Fix-CVE-2017-6386.patch" Content-Transfer-Encoding: quoted-printable =46rom 306ad14d580a8f8eb8366b8b32a54e22cf7c804e Mon Sep 17 00:00:00 2001 =46rom: Leo Famulari Date: Thu, 16 Mar 2017 14:13:08 -0400 Subject: [PATCH 1/2] gnu: virglrenderer: Fix CVE-2017-6386. * gnu/packages/patches/virglrenderer-CVE-2017-6386.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/spice.scm (virglrenderer)[source]: Use it. --- gnu/local.mk | 1 + .../patches/virglrenderer-CVE-2017-6386.patch | 54 ++++++++++++++++++= ++++ gnu/packages/spice.scm | 1 + 3 files changed, 56 insertions(+) create mode 100644 gnu/packages/patches/virglrenderer-CVE-2017-6386.patch diff --git a/gnu/local.mk b/gnu/local.mk index b3aa79ad9..c1a15e94f 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -965,6 +965,7 @@ dist_patch_DATA =3D \ %D%/packages/patches/upower-builddir.patch \ %D%/packages/patches/valgrind-enable-arm.patch \ %D%/packages/patches/vim-CVE-2017-5953.patch \ + %D%/packages/patches/virglrenderer-CVE-2017-6386.patch \ %D%/packages/patches/vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch \ %D%/packages/patches/vorbis-tools-CVE-2014-9640.patch \ %D%/packages/patches/vorbis-tools-CVE-2015-6749.patch \ diff --git a/gnu/packages/patches/virglrenderer-CVE-2017-6386.patch b/gnu/p= ackages/patches/virglrenderer-CVE-2017-6386.patch new file mode 100644 index 000000000..bd3bf106b --- /dev/null +++ b/gnu/packages/patches/virglrenderer-CVE-2017-6386.patch @@ -0,0 +1,54 @@ +Fix CVE-2017-6386 (memory leak introduced by fix for CVE-2017-5994). + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-5994 + +Patch copied from upstream source repository: + +https://cgit.freedesktop.org/virglrenderer/commit/?id=3D737c3350850ca4dbc5= 633b3bdb4118176ce59920 + +From 737c3350850ca4dbc5633b3bdb4118176ce59920 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Tue, 28 Feb 2017 14:52:09 +1000 +Subject: renderer: fix memory leak in vertex elements state create + +Reported-by: Li Qiang +Free the vertex array in error path. +This was introduced by this commit: +renderer: fix heap overflow in vertex elements state create. + +I rewrote the code to not require the allocation in the first +place if we have an error, seems nicer. + +Signed-off-by: Dave Airlie + +diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c +index 1bca7ad..e5d9f5c 100644 +--- a/src/vrend_renderer.c ++++ b/src/vrend_renderer.c +@@ -1648,18 +1648,19 @@ int vrend_create_vertex_elements_state(struct vren= d_context *ctx, + unsigned num_elements, + const struct pipe_vertex_element *= elements) + { +- struct vrend_vertex_element_array *v =3D CALLOC_STRUCT(vrend_vertex_el= ement_array); ++ struct vrend_vertex_element_array *v; + const struct util_format_description *desc; + GLenum type; + int i; + uint32_t ret_handle; +=20 +- if (!v) +- return ENOMEM; +- + if (num_elements > PIPE_MAX_ATTRIBS) + return EINVAL; +=20 ++ v =3D CALLOC_STRUCT(vrend_vertex_element_array); ++ if (!v) ++ return ENOMEM; ++ + v->count =3D num_elements; + for (i =3D 0; i < num_elements; i++) { + memcpy(&v->elements[i].base, &elements[i], sizeof(struct pipe_verte= x_element)); +--=20 +cgit v0.10.2 + diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm index 363a5e8fc..838db4b35 100644 --- a/gnu/packages/spice.scm +++ b/gnu/packages/spice.scm @@ -102,6 +102,7 @@ (uri (string-append "https://www.freedesktop.org/software/virgl/" "virglrenderer-" version ".tar.bz2")) + (patches (search-patches "virglrenderer-CVE-2017-6386.patch"= )) (sha256 (base32 "06kf0q4l52gzx5p63l8850hff8pmhp7xv1hk8zgx2apbw18y6jd5")))) --=20 2.12.0 --Nq2Wo0NMKNjxTN9z Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: attachment; filename="0002-gnu-qemu-Fix-CVE-2017-2620-2630.patch" Content-Transfer-Encoding: quoted-printable =46rom d4b92dc80b8a7e81e79b6a148b2ddbd98c3bc895 Mon Sep 17 00:00:00 2001 =46rom: Leo Famulari Date: Thu, 16 Mar 2017 14:58:13 -0400 Subject: [PATCH 2/2] gnu: qemu: Fix CVE-2017-{2620,2630}. * gnu/packages/patches/qemu-CVE-2017-2620.patch, gnu/packages/patches/qemu-CVE-2017-2630.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/qemu.scm (qemu)[source]: Use them. --- gnu/local.mk | 2 + gnu/packages/patches/qemu-CVE-2017-2620.patch | 134 ++++++++++++++++++++++= ++++ gnu/packages/patches/qemu-CVE-2017-2630.patch | 47 +++++++++ gnu/packages/qemu.scm | 2 + 4 files changed, 185 insertions(+) create mode 100644 gnu/packages/patches/qemu-CVE-2017-2620.patch create mode 100644 gnu/packages/patches/qemu-CVE-2017-2630.patch diff --git a/gnu/local.mk b/gnu/local.mk index c1a15e94f..2cc5d546b 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -877,6 +877,8 @@ dist_patch_DATA =3D \ %D%/packages/patches/python2-subprocess32-disable-input-test.patch \ %D%/packages/patches/qemu-CVE-2016-10155.patch \ %D%/packages/patches/qemu-CVE-2017-2615.patch \ + %D%/packages/patches/qemu-CVE-2017-2620.patch \ + %D%/packages/patches/qemu-CVE-2017-2630.patch \ %D%/packages/patches/qemu-CVE-2017-5525.patch \ %D%/packages/patches/qemu-CVE-2017-5526.patch \ %D%/packages/patches/qemu-CVE-2017-5552.patch \ diff --git a/gnu/packages/patches/qemu-CVE-2017-2620.patch b/gnu/packages/p= atches/qemu-CVE-2017-2620.patch new file mode 100644 index 000000000..d3111827b --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-2620.patch @@ -0,0 +1,134 @@ +Fix CVE-2017-2620: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-2620 +https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html + +Both patches copied from upstream source repository: + +Fixes CVE-2017-2620: +http://git.qemu-project.org/?p=3Dqemu.git;a=3Dcommit;h=3D92f2b88cea48c6aeb= a8de568a45f2ed958f3c298 + +The CVE-2017-2620 bug-fix depends on this earlier patch: +http://git.qemu-project.org/?p=3Dqemu.git;a=3Dcommit;h=3D913a87885f589d263= e682c2eb6637c6e14538061 + +From 92f2b88cea48c6aeba8de568a45f2ed958f3c298 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Wed, 8 Feb 2017 11:18:36 +0100 +Subject: [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovid= eo + (CVE-2017-2620) + +CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination +and blit width, at all. Oops. Fix it. + +Security impact: high. + +The missing blit destination check allows to write to host memory. +Basically same as CVE-2014-8106 for the other blit variants. + +Cc: qemu-stable@nongnu.org +Signed-off-by: Gerd Hoffmann +--- + hw/display/cirrus_vga.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 1deb52070a..b9e7cb1df1 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * = s) + { + int w; +=20 ++ if (blit_is_unsafe(s, true)) { ++ return 0; ++ } ++ + s->cirrus_blt_mode &=3D ~CIRRUS_BLTMODE_MEMSYSSRC; + s->cirrus_srcptr =3D &s->cirrus_bltbuf[0]; + s->cirrus_srcptr_end =3D &s->cirrus_bltbuf[0]; +@@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * = s) + } + s->cirrus_srccounter =3D s->cirrus_blt_srcpitch * s->cirrus_blt_h= eight; + } ++ ++ /* the blit_is_unsafe call above should catch this */ ++ assert(s->cirrus_blt_srcpitch <=3D CIRRUS_BLTBUFSIZE); ++ + s->cirrus_srcptr =3D s->cirrus_bltbuf; + s->cirrus_srcptr_end =3D s->cirrus_bltbuf + s->cirrus_blt_srcpitch; + cirrus_update_memory_access(s); +--=20 +2.12.0 + +From 913a87885f589d263e682c2eb6637c6e14538061 Mon Sep 17 00:00:00 2001 +From: Bruce Rogers +Date: Mon, 9 Jan 2017 13:35:20 -0700 +Subject: [PATCH] display: cirrus: ignore source pitch value as needed in + blit_is_unsafe + +Commit 4299b90 added a check which is too broad, given that the source +pitch value is not required to be initialized for solid fill operations. +This patch refines the blit_is_unsafe() check to ignore source pitch in +that case. After applying the above commit as a security patch, we +noticed the SLES 11 SP4 guest gui failed to initialize properly. + +Signed-off-by: Bruce Rogers +Message-id: 20170109203520.5619-1-brogers@suse.com +Signed-off-by: Gerd Hoffmann +--- + hw/display/cirrus_vga.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index bdb092ee9d..379910db2d 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -294,7 +294,7 @@ static bool blit_region_is_unsafe(struct CirrusVGAStat= e *s, + return false; + } +=20 +-static bool blit_is_unsafe(struct CirrusVGAState *s) ++static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + { + /* should be the case, see cirrus_bitblt_start */ + assert(s->cirrus_blt_width > 0); +@@ -308,6 +308,9 @@ static bool blit_is_unsafe(struct CirrusVGAState *s) + s->cirrus_blt_dstaddr & s->cirrus_addr_mask= )) { + return true; + } ++ if (dst_only) { ++ return false; ++ } + if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, + s->cirrus_blt_srcaddr & s->cirrus_addr_mask= )) { + return true; +@@ -673,7 +676,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAS= tate * s, +=20 + dst =3D s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mas= k); +=20 +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; +=20 + (*s->cirrus_rop) (s, dst, src, +@@ -691,7 +694,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, = int blt_rop) + { + cirrus_fill_t rop_func; +=20 +- if (blit_is_unsafe(s)) { ++ if (blit_is_unsafe(s, true)) { + return 0; + } + rop_func =3D cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwi= dth - 1]; +@@ -795,7 +798,7 @@ static int cirrus_do_copy(CirrusVGAState *s, int dst, = int src, int w, int h) +=20 + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; +=20 + return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +--=20 +2.12.0 + diff --git a/gnu/packages/patches/qemu-CVE-2017-2630.patch b/gnu/packages/p= atches/qemu-CVE-2017-2630.patch new file mode 100644 index 000000000..b154d171f --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2017-2630.patch @@ -0,0 +1,47 @@ +Fix CVE-2017-2630: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2017-2630 +https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html + +Patch copied from upstream source repository: + +http://git.qemu-project.org/?p=3Dqemu.git;a=3Dcommit;h=3D2563c9c6b8670400c= 48e562034b321a7cf3d9a85 + +From 2563c9c6b8670400c48e562034b321a7cf3d9a85 Mon Sep 17 00:00:00 2001 +From: Vladimir Sementsov-Ogievskiy +Date: Tue, 7 Mar 2017 09:16:27 -0600 +Subject: [PATCH] nbd/client: fix drop_sync [CVE-2017-2630] +MIME-Version: 1.0 +Content-Type: text/plain; charset=3DUTF-8 +Content-Transfer-Encoding: 8bit + +Comparison symbol is misused. It may lead to memory corruption. +Introduced in commit 7d3123e. + +Signed-off-by: Vladimir Sementsov-Ogievskiy +Message-Id: <20170203154757.36140-6-vsementsov@virtuozzo.com> +[eblake: add CVE details, update conditional] +Signed-off-by: Eric Blake +Reviewed-by: Marc-Andr=C3=A9 Lureau +Message-Id: <20170307151627.27212-1-eblake@redhat.com> +Signed-off-by: Paolo Bonzini +--- + nbd/client.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/nbd/client.c b/nbd/client.c +index 5c9dee37fa..3dc2564cd0 100644 +--- a/nbd/client.c ++++ b/nbd/client.c +@@ -94,7 +94,7 @@ static ssize_t drop_sync(QIOChannel *ioc, size_t size) + char small[1024]; + char *buffer; +=20 +- buffer =3D sizeof(small) < size ? small : g_malloc(MIN(65536, size)); ++ buffer =3D sizeof(small) >=3D size ? small : g_malloc(MIN(65536, size= )); + while (size > 0) { + ssize_t count =3D read_sync(ioc, buffer, MIN(65536, size)); +=20 +--=20 +2.12.0 + diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm index 3aa4128be..07ab871fa 100644 --- a/gnu/packages/qemu.scm +++ b/gnu/packages/qemu.scm @@ -79,6 +79,8 @@ "0qjy3rcrn89n42y5iz60kgr0rrl29hpnj8mq2yvbc1wrcizmvzfs")) (patches (search-patches "qemu-CVE-2016-10155.patch" "qemu-CVE-2017-2615.patch" + "qemu-CVE-2017-2620.patch" + "qemu-CVE-2017-2630.patch" "qemu-CVE-2017-5525.patch" "qemu-CVE-2017-5526.patch" "qemu-CVE-2017-5552.patch" --=20 2.12.0 --Nq2Wo0NMKNjxTN9z-- --DKU6Jbt7q3WqK7+M Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAljLBiEACgkQJkb6MLrK fwh6IhAA8aQI/wXrX07ZRVD9oRxRA7TOowf7j61ukG1Noe2uHhkX6gYVHDi+e4ZR 87fMCDDxUkLbj5JavZCscs68gr0PHHPeO7xtSgsMzfvA/yzXC6qG4Dkwg+j8jlpU +eq8CoDvutpsxybrrvL3BZ7WKauW0eloXApXuIAQZ+KrOoNXPH8f8Zb18BEaGO9Z ojwBxjeMxNCsZWVNNV+/k0x8uccNOGI9jgVhTNMYh4Yk+eNaJaZzN4s3mxhKRI84 ZgDURw7neO/tE125WsMthvEiF+MuSH8tHtxXxaBHzQm98M1JGKZruIB0c2WAKGIN RpxGUaX97WDKkdb6wfCKPBFjrINzATG4/yFCGiNtnaU5vtMGSz0jRDO4d7TVpKHj 8oiv9ezRpa5J7hiDghNB2gttDF1YqQyZAZzOs0fMdDnnjuEb8kdeLs37gtHhrgXV EeWlK8qyx2G0zYtAJEKnPerTRWCZaizx5fFLsgAICasLJIiqPjqsG+uTo4a9PvPN jDBhxcEuXgBUgIR4iJgQVw9apoZcwzmdRS6Fx4iy8Fz0IJkuyk/D0PnAPpbUF7xD KLAnm4+9LpIFxM9+YGgOr39qC15EJIZYL2PKd14bMYqMBpZmH2QEwBa2MWslqcsq 6xInOFFpLxMkte9WI8cc0GpzvNPI7/1f8nJ38RG/Vtf/ngFY0n4= =lhJ/ -----END PGP SIGNATURE----- --DKU6Jbt7q3WqK7+M-- From debbugs-submit-bounces@debbugs.gnu.org Thu Mar 16 18:18:44 2017 Received: (at 26134) by debbugs.gnu.org; 16 Mar 2017 22:18:44 +0000 Received: from localhost ([127.0.0.1]:59385 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1codjH-0005ih-LU for submit@debbugs.gnu.org; Thu, 16 Mar 2017 18:18:44 -0400 Received: from sender-of-o51.zoho.com ([135.84.80.216]:21071) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1codjD-0005iV-PL for 26134@debbugs.gnu.org; Thu, 16 Mar 2017 18:18:42 -0400 Received: from localhost (xd9ba2140.dyn.telefonica.de [217.186.33.64]) by mx.zohomail.com with SMTPS id 1489702715356364.0784968163075; Thu, 16 Mar 2017 15:18:35 -0700 (PDT) References: <20170316213945.GA8120@jasmine> User-agent: mu4e 0.9.18; emacs 25.1.1 From: Ricardo Wurmus To: Leo Famulari Subject: Re: bug#26134: QEMU and virglrenderer security CVE-2017-6386 CVE-2017-2620 CVE-2017-2630 In-reply-to: <20170316213945.GA8120@jasmine> X-URL: https://elephly.net X-PGP-Key: https://elephly.net/rekado.pubkey X-PGP-Fingerprint: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC Date: Thu, 16 Mar 2017 23:18:32 +0100 Message-ID: <87a88kzwzr.fsf@elephly.net> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: -1.8 (-) X-Debbugs-Envelope-To: 26134 Cc: 26134@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.8 (-) Leo Famulari writes: > From 306ad14d580a8f8eb8366b8b32a54e22cf7c804e Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Thu, 16 Mar 2017 14:13:08 -0400 > Subject: [PATCH 1/2] gnu: virglrenderer: Fix CVE-2017-6386. > > * gnu/packages/patches/virglrenderer-CVE-2017-6386.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/spice.scm (virglrenderer)[source]: Use it. LGTM! > From d4b92dc80b8a7e81e79b6a148b2ddbd98c3bc895 Mon Sep 17 00:00:00 2001 > From: Leo Famulari > Date: Thu, 16 Mar 2017 14:58:13 -0400 > Subject: [PATCH 2/2] gnu: qemu: Fix CVE-2017-{2620,2630}. > > * gnu/packages/patches/qemu-CVE-2017-2620.patch, > gnu/packages/patches/qemu-CVE-2017-2630.patch: New files. > * gnu/local.mk (dist_patch_DATA): Add them. > * gnu/packages/qemu.scm (qemu)[source]: Use them. LGTM! Thank you for applying these fixes! -- Ricardo GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC https://elephly.net From debbugs-submit-bounces@debbugs.gnu.org Thu Mar 16 19:49:38 2017 Received: (at 26134-done) by debbugs.gnu.org; 16 Mar 2017 23:49:38 +0000 Received: from localhost ([127.0.0.1]:59403 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cof9G-0007zd-Jt for submit@debbugs.gnu.org; Thu, 16 Mar 2017 19:49:38 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:55140) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cof9E-0007zV-Bq for 26134-done@debbugs.gnu.org; Thu, 16 Mar 2017 19:49:37 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id BDF6E20AFA; Thu, 16 Mar 2017 19:49:35 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Thu, 16 Mar 2017 19:49:35 -0400 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=famulari.name; h= cc:content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=mesmtp; bh=HPO13iSDVXelWu+eKWN+IV1q6EY=; b=W8Atje iqesBPrxRer/RnAXLVZuCjtNOy9jSCyUzlcqUYfAUjZMNOxNWDwa3GD/Yw3q3Gnk ST3bG/j/xnN13ykmOG/2iezpFJfFeAg6ec9Y5VWZU7xVJBc/Q7GJZuvEOusENPpH e1dCE0p8ZsqFmAnhil2VSXADVJaji5fmCcXlI= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=HPO13iSDVXelWu+eKW N+IV1q6EY=; b=SWuxJK/MFPNaLlBnQ0f9TYiT5AW92GKN0mnGLvBp9CkzORFFxa 7l1JwSL5XJUthS2wYaelqzSNmvugRc5yZQ4R0GRoaQ/kQ8SUEPbaJBPm389S9w9h iXvv32tWMw3eW0tyZwE2m4JofHLVQ62NgPgJu9LrKoP6JwuVeL1tKAwphDsW+CGa ZQSA1IT75jznhcPZAhH72kYd60Wb6rfMlIlgN+Ga/5kJWzgCg/X42MqKzk8s/Xw7 Izr91T8nbFuSokjIIdAzUF3slPBYCAJ4uVHf7a1crJcwGz+MzeNJ41u4+LhybT1p qqPwiAS/TrywRFDdt9FiI6/WWKTv1DRts8lg== X-ME-Sender: X-Sasl-enc: mfqUtWI/gA3Xx7tI5RiOrGKJlVNB9406r7tl+Z6ONX37 1489708175 Received: from localhost (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 7F82C24519; Thu, 16 Mar 2017 19:49:35 -0400 (EDT) Date: Thu, 16 Mar 2017 19:49:33 -0400 From: Leo Famulari To: Ricardo Wurmus Subject: Re: bug#26134: QEMU and virglrenderer security CVE-2017-6386 CVE-2017-2620 CVE-2017-2630 Message-ID: <20170316234933.GA25811@jasmine> References: <20170316213945.GA8120@jasmine> <87a88kzwzr.fsf@elephly.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87a88kzwzr.fsf@elephly.net> User-Agent: Mutt/1.8.0 (2017-02-23) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 26134-done Cc: 26134-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) On Thu, Mar 16, 2017 at 11:18:32PM +0100, Ricardo Wurmus wrote: > Leo Famulari writes: > > Subject: [PATCH 1/2] gnu: virglrenderer: Fix CVE-2017-6386. > > LGTM! > > > Subject: [PATCH 2/2] gnu: qemu: Fix CVE-2017-{2620,2630}. > > LGTM! Pushed! From unknown Fri Sep 19 23:37:39 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Fri, 14 Apr 2017 11:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator