From 538a0ddaf463789f830140d37b8050a3ecdee89d Mon Sep 17 00:00:00 2001 From: zhaosai Date: Mon, 1 Sep 2025 09:35:37 +0800 Subject: [PATCH] Fix CVE-2020-10232 --- CVE-2020-10232.patch | 23 +++++++++++++++++++++++ sleuthkit.spec | 6 +++++- 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-10232.patch diff --git a/CVE-2020-10232.patch b/CVE-2020-10232.patch new file mode 100644 index 0000000..733ab95 --- /dev/null +++ b/CVE-2020-10232.patch @@ -0,0 +1,23 @@ +From 459ae818fc8dae717549810150de4d191ce158f1 Mon Sep 17 00:00:00 2001 +From: micrictor +Date: Sat, 22 Feb 2020 12:17:25 -0800 +Subject: [PATCH] Fix stack buffer overflow in yaffsfs_istat + +Prevent a stack buffer overflow in yaffsfs_istat by increasing the buffer size to the size required by tsk_fs_time_to_str. +--- + tsk/fs/yaffs.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tsk/fs/yaffs.cpp b/tsk/fs/yaffs.cpp +index 68d8b0219b..f5ec30a09d 100755 +--- a/tsk/fs/yaffs.cpp ++++ b/tsk/fs/yaffs.cpp +@@ -2439,7 +2439,7 @@ static uint8_t + YAFFSFS_INFO *yfs = (YAFFSFS_INFO *)fs; + char ls[12]; + YAFFSFS_PRINT_ADDR print; +- char timeBuf[32]; ++ char timeBuf[128]; + YaffsCacheObject * obj = NULL; + YaffsCacheVersion * version = NULL; + YaffsHeader * header = NULL; diff --git a/sleuthkit.spec b/sleuthkit.spec index 535e7d5..5a04103 100644 --- a/sleuthkit.spec +++ b/sleuthkit.spec @@ -1,6 +1,6 @@ Name: sleuthkit Version: 4.6.7 -Release: 10 +Release: 11 Summary: Tools for file system and volume forensic analysis License: CPL and IBM and GPLv2+ URL: http://www.sleuthkit.org @@ -17,6 +17,7 @@ Patch8: 0008-left-shift.patch Patch9: fix-memleak-in-ntfs.patch Patch10: Check-avalable-allocated-space-before-attempting-to.patch Patch11: Fix-for-invalid-shift-issue-1088.patch +Patch12: CVE-2020-10232.patch BuildRequires: gcc-c++ afflib-devel >= 3.3.4 libewf-devel perl-generators sqlite-devel @@ -91,6 +92,9 @@ sed -i.rpath 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool %{_mandir}/man1/* %changelog +* Mon Sep 01 2025 Saisai Zhao - 4.6.7-11 +- Fix CVE-2020-10232 + * Thu Dec 16 2021 chenchen - 4.6.7-10 - fix for invalid shift -- Gitee