67d94fecb0
This is inactive project, so no official CVE fix will be available anymore. That however does not mean that there is no fix available. Following tries to prove that patch provided here is valid. NVD CVE report [1] links issue [2] where this is reported. Based on the report, fix was proposed in [3]. There was some review however the patch autor was not active. [4] was later created trying to adddress the comments, but the project was not active anymore. In this PR the patch was shrunk to a one-liner in discussion. I have tested the poc and it is real. The patch fixes it, while not breaking the execution if good file path is provided as argument. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-43361 [2] https://github.com/xiph/vorbis-tools/issues/41 [3] https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/7 [4] https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/8 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> |
||
|---|---|---|
| .. | ||
| classes | ||
| conf | ||
| files | ||
| licenses | ||
| recipes-connectivity | ||
| recipes-dvb | ||
| recipes-mkv | ||
| recipes-multimedia | ||
| recipes-support | ||
| COPYING.MIT | ||
| README.md | ||
| SECURITY.md | ||
This layer depends on:
URI: git://git.openembedded.org/openembedded-core branch: master
URI: git://git.openembedded.org/meta-openembedded layers: meta-oe branch: master
Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-multimedia]' in the subject
When sending single patches, please use something like: git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-multimedia][PATCH'
You are encouraged to fork the mirror on github https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch. Other services like GitLab, repo.or.cz or self hosted setups are of course accepted as well, 'git fetch ' works the same on all of them. We recommend github because it is free, easy to use, has been proven to be reliable and has a really good web GUI.
Layer maintainer: Andreas Müller schnitzeltony@gmail.com