From fd72976a4904865b7652317381633ec81d273ef595c942e3cddd84c471d31ac5 Mon Sep 17 00:00:00 2001 From: Dirk Mueller Date: Mon, 27 Nov 2017 10:01:58 +0000 Subject: [PATCH] - exim-CVE-2017-16943.patch: fixed possible code execution (CVE-2017-16943 bsc#1069857) OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=194 --- exim-CVE-2017-16943.patch | 40 +++++++++++++++++++++++++++++++++++++++ exim.changes | 5 +++++ exim.spec | 6 ++++-- 3 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 exim-CVE-2017-16943.patch diff --git a/exim-CVE-2017-16943.patch b/exim-CVE-2017-16943.patch new file mode 100644 index 0000000..5de1597 --- /dev/null +++ b/exim-CVE-2017-16943.patch @@ -0,0 +1,40 @@ +From 4e6ae6235c68de243b1c2419027472d7659aa2b4 Mon Sep 17 00:00:00 2001 +From: Jeremy Harris +Date: Fri, 24 Nov 2017 20:22:33 +0000 +Subject: [PATCH] Avoid release of store if there have been later allocations. + Bug 2199 + +--- + src/src/receive.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/src/src/receive.c b/src/src/receive.c +index e7e518a..d9b5001 100644 +--- a/src/receive.c ++++ b/src/receive.c +@@ -1810,8 +1810,8 @@ for (;;) + (and sometimes lunatic messages can have ones that are 100s of K long) we + call store_release() for strings that have been copied - if the string is at + the start of a block (and therefore the only thing in it, because we aren't +- doing any other gets), the block gets freed. We can only do this because we +- know there are no other calls to store_get() going on. */ ++ doing any other gets), the block gets freed. We can only do this release if ++ there were no allocations since the once that we want to free. */ + + if (ptr >= header_size - 4) + { +@@ -1820,9 +1820,10 @@ for (;;) + header_size *= 2; + if (!store_extend(next->text, oldsize, header_size)) + { ++ BOOL release_ok = store_last_get[store_pool] == next->text; + uschar *newtext = store_get(header_size); + memcpy(newtext, next->text, ptr); +- store_release(next->text); ++ if (release_ok) store_release(next->text); + next->text = newtext; + } + } +-- +1.9.1 + diff --git a/exim.changes b/exim.changes index a07e420..8a13d8d 100644 --- a/exim.changes +++ b/exim.changes @@ -7,6 +7,11 @@ Mon Nov 27 08:52:33 UTC 2017 - kstreitova@suse.com * upstream commits: a12400fd4493b676e71613ab429e731f777ebd1e and 31beb7972466a33a88770eacbce13490f2ddadc2 +------------------------------------------------------------------- +Mon Nov 27 06:45:14 UTC 2017 - meissner@suse.com + +- exim-CVE-2017-16943.patch: fixed possible code execution (CVE-2017-16943 bsc#1069857) + ------------------------------------------------------------------- Thu Nov 23 13:43:04 UTC 2017 - rbrown@suse.com diff --git a/exim.spec b/exim.spec index b625256..f282d98 100644 --- a/exim.spec +++ b/exim.spec @@ -111,7 +111,8 @@ Patch0: exim-tail.patch Patch1: exim-4.86.2+fixes-867e8fe25dbfb1e31493488ad695bde55b890397.patch Patch2: fix-CVE-2016-9963-31c02defdc5118834e801d4fe8f11c1d9b5ebadf.patch Patch3: exim-CVE-2017-1000369.patch -Patch4: exim-4.86.2-mariadb_102_compile_fix.patch +Patch4: exim-CVE-2017-16943.patch +Patch5: exim-4.86.2-mariadb_102_compile_fix.patch %package -n eximon Summary: Eximon, an graphical frontend to administer Exim's mail queue @@ -158,6 +159,7 @@ once, if at all. The rest is done by logrotate / cron.) %patch2 -p 1 %patch3 -p 1 %patch4 -p 1 +%patch5 -p 1 # build with fPIE/pie on SUSE 10.0 or newer, or on any other platform %if %{?suse_version:%suse_version}%{?!suse_version:99999} > 930 fPIE="-fPIE" @@ -300,7 +302,7 @@ cat <<-EOF > Local/Makefile %if %{with i18n} EXPERIMENTAL_INTERNATIONAL=yes %endif - LDFLAGS += -lidn + LDFLAGS += -lidn CFLAGS=$RPM_OPT_FLAGS -Wall $CFLAGS_OPT_WERROR -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -DLDAP_DEPRECATED $fPIE EXTRALIBS=-ldl -lpam -L/usr/X11R6/%{_lib} $pie EOF