diff --git a/avahi.spec b/avahi.spec index dfe05d0917b0c4c183f2178d54ab84a60f877861..c8ddded77bd78ffda45a0eb94f4077352a022b7b 100644 --- a/avahi.spec +++ b/avahi.spec @@ -3,7 +3,7 @@ Name: avahi Version: 0.8 -Release: 14 +Release: 15 Summary: Avahi is a local network service discovery License: LGPLv2+ URL: http://avahi.org @@ -19,6 +19,7 @@ Patch5: 0005-avahi_dns_packet_consume_uint32-fix-potential-undefi.patc Patch6001: backport-CVE-2021-3468.patch Patch6002: backport-CVE-2021-36217.patch +Patch6003: backport-CVE-2023-1981.patch BuildRequires: gcc automake libtool desktop-file-utils gtk2-devel glib2-devel gcc-c++ BuildRequires: libcap-devel expat-devel gdbm-devel make @@ -556,6 +557,9 @@ fi %{_mandir}/man8/* %changelog +* Wed Apr 12 2023 zhouwenpei - 0.8-15 +- fix CVE-2023-1981 + * Tue Dec 20 2022 zhouwenpei - 0.8-14 - add BuildRequires make diff --git a/backport-CVE-2023-1981.patch b/backport-CVE-2023-1981.patch new file mode 100644 index 0000000000000000000000000000000000000000..d1f05b7b72d404daf34476c896e1a568898e6c61 --- /dev/null +++ b/backport-CVE-2023-1981.patch @@ -0,0 +1,53 @@ +From a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 17 Nov 2022 01:51:53 +0100 +Subject: [PATCH] Emit error if requested service is not found + +It currently just crashes instead of replying with error. Check return +value and emit error instead of passing NULL pointer to reply. + +Fixes #375 +--- + avahi-daemon/dbus-protocol.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/avahi-daemon/dbus-protocol.c b/avahi-daemon/dbus-protocol.c +index 70d7687bc..406d0b441 100644 +--- a/avahi-daemon/dbus-protocol.c ++++ b/avahi-daemon/dbus-protocol.c +@@ -375,10 +375,14 @@ static DBusHandlerResult dbus_get_alternative_host_name(DBusConnection *c, DBusM + } + + t = avahi_alternative_host_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Hostname not found"); ++ } + } + + static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DBusMessage *m, DBusError *error) { +@@ -389,10 +393,14 @@ static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DB + } + + t = avahi_alternative_service_name(n); +- avahi_dbus_respond_string(c, m, t); +- avahi_free(t); ++ if (t) { ++ avahi_dbus_respond_string(c, m, t); ++ avahi_free(t); + +- return DBUS_HANDLER_RESULT_HANDLED; ++ return DBUS_HANDLER_RESULT_HANDLED; ++ } else { ++ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Service not found"); ++ } + } + + static DBusHandlerResult dbus_create_new_entry_group(DBusConnection *c, DBusMessage *m, DBusError *error) {