diff options
| author | yanjun.zhu <yanjun.zhu@windriver.com> | 2012-12-11 18:00:32 +0800 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2012-12-17 17:24:54 +0000 |
| commit | 5b3ffcea5e08fe097b417e29c7282ed37feaacc7 (patch) | |
| tree | 631c70d9be633f2739e4ead74673100acda1f932 /README.hardware | |
| parent | f023d0589815a0068435b711e723d21c9560e30d (diff) | |
| download | ast2050-yocto-poky-5b3ffcea5e08fe097b417e29c7282ed37feaacc7.zip ast2050-yocto-poky-5b3ffcea5e08fe097b417e29c7282ed37feaacc7.tar.gz | |
squashfs: fix CVE-2012-4025
CQID:WIND00366813
Reference: http://squashfs.git.sourceforge.net/git/gitweb.cgi?
p=squashfs/squashfs;a=patch;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e
Integer overflow in the queue_init function in unsquashfs.c in
unsquashfs in Squashfs 4.2 and earlier allows remote attackers
to execute arbitrary code via a crafted block_log field in the
superblock of a .sqsh file, leading to a heap-based buffer overflow.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4025
(From OE-Core rev: bb1611d4830bb7aff2371afdb2a77a4ca7298c7d)
Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com>
[YOCTO #3564]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'README.hardware')
0 files changed, 0 insertions, 0 deletions
