diff --git a/zlib-1.2.13.tar.xz b/zlib-1.2.13.tar.xz deleted file mode 100644 index c01659e5852d0d97ea690c0149293be33e16f37b..0000000000000000000000000000000000000000 Binary files a/zlib-1.2.13.tar.xz and /dev/null differ diff --git a/zlib-1.3.1.tar.xz b/zlib-1.3.1.tar.xz new file mode 100644 index 0000000000000000000000000000000000000000..208383702a1aaa90253e11bfa3b5da47c6105f14 Binary files /dev/null and b/zlib-1.3.1.tar.xz differ diff --git a/zlib-CVE-2023-45853.patch b/zlib-CVE-2023-45853.patch deleted file mode 100644 index 784c57766f20f03523fdc9aab3bb0b25a6d7c34f..0000000000000000000000000000000000000000 --- a/zlib-CVE-2023-45853.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 73331a6a0481067628f065ffe87bb1d8f787d10c Mon Sep 17 00:00:00 2001 -From: Hans Wennborg -Date: Fri, 18 Aug 2023 11:05:33 +0200 -Subject: [PATCH] Reject overflows of zip header fields in minizip. - -This checks the lengths of the file name, extra field, and comment -that would be put in the zip headers, and rejects them if they are -too long. They are each limited to 65535 bytes in length by the zip -format. This also avoids possible buffer overflows if the provided -fields are too long. ---- - contrib/minizip/zip.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c -index 3d3d4cadd..0446109b2 100644 ---- a/contrib/minizip/zip.c -+++ b/contrib/minizip/zip.c -@@ -1043,6 +1043,17 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c - return ZIP_PARAMERROR; - #endif - -+ // The filename and comment length must fit in 16 bits. -+ if ((filename!=NULL) && (strlen(filename)>0xffff)) -+ return ZIP_PARAMERROR; -+ if ((comment!=NULL) && (strlen(comment)>0xffff)) -+ return ZIP_PARAMERROR; -+ // The extra field length must fit in 16 bits. If the member also requires -+ // a Zip64 extra block, that will also need to fit within that 16-bit -+ // length, but that will be checked for later. -+ if ((size_extrafield_local>0xffff) || (size_extrafield_global>0xffff)) -+ return ZIP_PARAMERROR; -+ - zi = (zip64_internal*)file; - - if (zi->in_opened_file_inzip == 1) diff --git a/zlib.spec b/zlib.spec index 62555cd0bb1be60cef1416745a79f3fb830ecb3b..0ac137802afa95e343b10e3ee2e3deb15901ec08 100644 --- a/zlib.spec +++ b/zlib.spec @@ -1,14 +1,12 @@ -%define anolis_release 2 +%define anolis_release 1 Name: zlib -Version: 1.2.13 +Version: 1.3.1 Release: %{anolis_release}%{?dist} Summary: Compression and decompression library License: zlib and Boost URL: https://www.zlib.net/ Source0: https://zlib.net/zlib-%{version}.tar.xz -# https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c -Patch0: zlib-CVE-2023-45853.patch BuildRequires: make automake autoconf libtool %description @@ -117,6 +115,9 @@ make test %changelog +* Tue Jan 23 2024 Funda Wang - 1.3.1-1 +- New version 1.3.1 + * Sat Oct 21 2023 Funda Wang - 1.2.13-2 - Fix CVE-2023-45853