From 3f536edfa56ce3f93223c23ed48427a0c24ede1a Mon Sep 17 00:00:00 2001 From: Rahul Taya Date: Thu, 30 Jul 2020 14:11:51 +0530 Subject: libpcre: Add fix for CVE-2020-14155 Added below patch in libpcre CVE-2020-14155.patch This patch fixes below error: PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre via a large number after (?C substring. By sending a request with a large number, an attacker can execute arbitrary code on the system or cause the application to crash. Tested-by: Rahul Taya Signed-off-by: Saloni Jain Signed-off-by: Anuj Mittal --- meta/recipes-support/libpcre/libpcre_8.43.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-support/libpcre/libpcre_8.43.bb') diff --git a/meta/recipes-support/libpcre/libpcre_8.43.bb b/meta/recipes-support/libpcre/libpcre_8.43.bb index b97af08b25..60ece64504 100644 --- a/meta/recipes-support/libpcre/libpcre_8.43.bb +++ b/meta/recipes-support/libpcre/libpcre_8.43.bb @@ -12,6 +12,7 @@ SRC_URI = "https://ftp.pcre.org/pub/pcre/pcre-${PV}.tar.bz2 \ file://out-of-tree.patch \ file://run-ptest \ file://Makefile \ + file://CVE-2020-14155.patch \ " SRC_URI[md5sum] = "636222e79e392c3d95dcc545f24f98c4" -- cgit 1.2.3-korg